Extracted

• • Target

    file.exe

  • Size

    3.0MB

  • MD5

    be1e5f16ba15534a69248555daea25a5

  • SHA1

    b6f7090c2e7676268523cc303b75aeba5bad7e6d

  • SHA256

    47cad489ed7b741695a2d2a3c14350078867de45368c94188343c9fb4d79980f

  • SHA512

    2ee12e5b3c8e2426ab5824f080bf3c04688322e8579c8d317dc3bd60475fe723b5e329940a210211de101d986109d69bf080eac88e18b79cc507c3c1a9068210

  • SSDEEP

    12288:uCXs2sBkTI/gwxAk9xLXRGzmkA3FazV4c0e/uTf58uAOSQKs0LXb5Ks1TMLPVttZ:uzb/rckazKc0eq8uAOSHLX1T4PVbTl

  Score

  10^/10

  xwormdiscoveryrattrojan

  • Detect Xworm Payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2