Extracted

• • Target

    AnneAnderson_Carousel1.jpg

  • Size

    254KB

  • MD5

    08b0ce1a795327abb586f3d14f935dc5

  • SHA1

    c3f5cecc4fc53a213ba8a18a0230762aafc120d5

  • SHA256

    20a271edc581a10996cbdf278e4cd05cfb01c87e54a4e01a282eacc13b6ffc18

  • SHA512

    0746a12bc958d973941e11f0c30773312bc43c9e64254231c9b89cd3f19b48236315b2f9300835719470a108fd80dc9daa573871fd0056e61039dca842357819

  • SSDEEP

    6144:hf4Lvmd4bGJNAtm/t8Xw58oznFpBRzb47gEvOwLc:Cqdq+KtGtv8a/BRg8E2ww

  Score

  10^/10

  xwormdiscoverypersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1