Extracted

• • Target

    Admin Tools.rar.exe

  • Size

    11.8MB

  • MD5

    ddcffb7143bb8073f53391fd44159950

  • SHA1

    e55cfccc6eefd6c8079f6e18459a3eb509107bd2

  • SHA256

    ddfe0cfb0d6ff02a67de60e59a1f212403d075eb1afebccb7e21e094d463a33a

  • SHA512

    1538f3ee18787485e727904eeac50ea6dbf207ff5aa61620223a33aa5c7c743d17c1ab9c499f04cb6e3954c28434f0dd01ef94412e2a62a94e77d9f996a8db27

  • SSDEEP

    196608:lQXFWvrR+RBZuLVESPp94EMtwBVxCS8ns71EWradV3qAo5QiPZbdBD8h5sf0IfvB:l/URsVz2Z6BVxGmbeV3qc35sfFRf

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1