Extracted

• • Target

    file.exe

  • Size

    1.4MB

  • MD5

    3d3459b0630ce9dc45b177b697ca23a0

  • SHA1

    0245c62e5155dd121bd3b31af02e5bf62bb01e71

  • SHA256

    40d07a9b787d52381da6ce75c088f62eb009baffd98858660670715976ad7cc5

  • SHA512

    2016ada15909d95c7518cf8f803f1ecd05c8f1d1325be1e8c2ac3c7e5b24e9da58dccef9ac7e978e660bbe4f93096d2e483f84ac8b088d72e119b76f2f4d56b9

  • SSDEEP

    24576:2/vN2wSUb01BxVVZCfQ7jnOqBpoZk7g8Ll4LMhrsyPBUj8Zpn9BxjZVpTyGZI2:2/l28QjxVCfszOqB6ZB2P1TVTRyGB

  Score

  10^/10

  discoveryxwormrattrojan

  • Detect Xworm Payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2