Extracted

• • Target

    4badc43e761b7a46c9aed5a91a47605ce590b21f2a2126203cd1f264ea6eb81f

  • Size

    2.7MB

  • MD5

    ecd6e35111d8553e8c8b9a6d49120642

  • SHA1

    f9e19739a6ec2be180eb56c95fc422d49d0d36de

  • SHA256

    4badc43e761b7a46c9aed5a91a47605ce590b21f2a2126203cd1f264ea6eb81f

  • SHA512

    50662478344f2079ee343499b69ba18062ba56816715baefc9f3f6a4976b26c32ea142b6b17657b03fc4b91babafa5f55fa0768309d5f8db350fca125bee3473

  • SSDEEP

    49152:GjwzUTCh+Ha4I0ld3Ivjs+8I2m4V6PSBM3tmnWFUy1oGQhsKtAHkew6aO68:JlSaB0levem4EaBqYWfQzake

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2