Extracted

• • Target

    ac9ef83f6d6ae646a08a97ecfe311a8beddacc41e0add58f8516b657f627ee18N

  • Size

    37KB

  • MD5

    d8dfc68d21a7cdd095bc03963a8b2fb0

  • SHA1

    7d132da41aa0180c5895132e559f6245f1feacbc

  • SHA256

    ac9ef83f6d6ae646a08a97ecfe311a8beddacc41e0add58f8516b657f627ee18

  • SHA512

    32080903a12794c3e60d8572a7c50b693a5f988fabd1679bbcce9e1bba2a6e038fa023ad95b95dd00d14e08b1ea95194ce03e371bef29b67be4a2c01872c8637

  • SSDEEP

    768:ztGRiYTgP/NNo5GfjS61216La/FP192iOphi7X:zkRi+gsGu6McLgFt92iOpeX

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2