Extracted

• • Target

    decc2a2ef08d8d31a013fafb410abd99fe7d9c31fe7801ef4bed7682e09682b7N

  • Size

    352KB

  • MD5

    c7f28af5b86f96194ea63fb9327a9a60

  • SHA1

    099afe5387be0147ca0dc1ee96ac29e57fc0ec4a

  • SHA256

    decc2a2ef08d8d31a013fafb410abd99fe7d9c31fe7801ef4bed7682e09682b7

  • SHA512

    3e2c0eb8252a584ae8ab963a1e60f18b9d17c7faf625a87d197861f0cd69bb7f9e85842f6c2ef007f53fd7a7791cd1650ec92bc98a8c169fd0a8f74a8a8eca89

  • SSDEEP

    6144:0BAOAWfF1oIMNJ6hMsQN9+/qtW59OJKOvpvvLIboRoaos03ZbqgsBQxBt25:qpF1a+h2N9+St8uK6vvEboRoaotbquxX

  Score

  10^/10

  xwormdiscoveryrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2