Extracted

• • Target

    injector.exe

  • Size

    36KB

  • MD5

    1d9727f02bd353afc1fedee98e4acfbb

  • SHA1

    2263f809ead639430a130976ea4722aacb3e1362

  • SHA256

    26eb0d93904680fef2d4df49b9d55a6e54f8b341a888bb6bec2fec1e711e9536

  • SHA512

    62390fc747f737a15879a521f68827ab73dd26e1ee08837f3eaad542dc435703f98552b187aa19c760dc3a12c1a4d183c4d5450e4458c1a1111f131fd3de97cc

  • SSDEEP

    768:F2C78uvbhLyScu6JBbTZ6VFyc9PZO/h7AX:Ft78utLySuJBbTZwF39PZO/KX

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2