Extracted

• • Target

    cb809403804dda0781d3ad0d3758b238c60258620158cd1a6e1e4392ba82ec5eN.exe

  • Size

    50KB

  • MD5

    564993fe4cb3bc168f9886c4859d7d90

  • SHA1

    18a3d1237e29c40ded4e08be27afc048f9f9352b

  • SHA256

    cb809403804dda0781d3ad0d3758b238c60258620158cd1a6e1e4392ba82ec5e

  • SHA512

    240832c69d5986bec0c8253bc9b91c433295bc23810429f3e0387b79a5e1af67d869795d1bbe3c9351f50ddfae9734d202171695cfc93cd9afad8c4a5d4eb493

  • SSDEEP

    768:AvPzXMVK5uDLY894aZzde0Qnkbb5OfIhWsHQChaYpGAvOgi5hnW8xAn:4XMlPYAWXkbb5GPTYUKOFLY

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2