Extracted

• • Target

    GUIสุดโหด.exe

  • Size

    1.9MB

  • MD5

    0065484c8645d1858fc6d542c5cceac7

  • SHA1

    b9e6f410bd59a15c0a89ddb3c06d0ac11ae655f4

  • SHA256

    ad7b3092e0b6abb5a978579bf2ebbcd3abde31e3e62ccf1a7c70fa7584885f34

  • SHA512

    cec0ea7433e3fa967d521f4d0c66e5a71c55c0230bf9764d4dc9f33acbdd463ea2b11592266af9b2e6767968354f12d93a1a53f3d23dc6961961fbb3dda45661

  • SSDEEP

    24576:3VwDp0VIi/j82FYvEsHxmOtX+zDdnLXY0NgBZFHGx:3VI0VIi/KEAac0NgBZF

  Score

  10^/10

  xwormdiscoveryevasionpersistenceprivilege_escalationransomwarerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery
  behavioral1