Extracted

• • Target

    ac9ef83f6d6ae646a08a97ecfe311a8beddacc41e0add58f8516b657f627ee18N.exe

  • Size

    37KB

  • MD5

    2efa1b0fccd8c71d0e50c32d5fee164c

  • SHA1

    0e04e3f8dc5e1b8666f0b302746cbb4c1005e9a3

  • SHA256

    1a7549e698cf8dd9b02942a972f457da2519467ca8cbf439cfe573708caba41a

  • SHA512

    a1a7f05aee4d2e7e6414b2c1a58375ba5aa70a707883e46c588b292517de890c26e37fe6d191a2428a870de99a26f5d6957ab032618c878218b9cc62b85d4500

  • SSDEEP

    768:ztGRiYTgP/NNo5GfjS61216La/FP192iOphi7X0:zkRi+gsGu6McLgFt92iOpeX0

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2