Extracted

• • Target

    Luigi UnBan.exe

  • Size

    178.2MB

  • MD5

    fdaf5b201a0e1c706e755cf2dcf6adb4

  • SHA1

    015461363ad9a3897d2ea5deda2fa44fe57756f3

  • SHA256

    0f3a0a876e198379b45b75a0c06ee8f3cab91eb26fd868fab769ed72b804f600

  • SHA512

    cc0e9a65170e318a4faad0a28aa7458dc0367027b7419049b0dce2baa1df535e7f776395b904be8466b055b1a40a97317cead9adb96afde637e82343f4d1ba91

  • SSDEEP

    1572864:3gm3YzFXmdksvLt/u5ZnKBE5MoDNU0gj67dnHE7:3gm3YYdkqZu6E5Mg7dK

  Score

  10^/10

  executionxwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2