Extracted

• • Target

    Steam Servers Starter.exe

  • Size

    328KB

  • MD5

    118058cb2e49ff809845d5543a8ee5c8

  • SHA1

    f7289d94b973fcbe0a064ed798c9328abecffca0

  • SHA256

    1133b725403821998bc9750d965d028ae078a3cc8d6014cbf231f7fb40a14f92

  • SHA512

    594bc589ca60bd653fabf72c34fb7e69de25643cbe19bbe1ed5e406390d7b6ac58c7adf76d66fc22d998b35bcfa5e0b07932aa6b73aee8cab1c277301c71bbf4

  • SSDEEP

    6144:rWBIIzFb83+GIIIIIIIhIIIIIIIIIIIIIIIU:qBIUi4

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1