Extracted

• • Target

    Bloxstrap-v2.8.1.exe

  • Size

    11.2MB

  • MD5

    5d16971f4e0d6e5f99d18d28672cc621

  • SHA1

    bcd7f4fe26313fe3ced6ced1f5952d6429fac416

  • SHA256

    fc16219abe3f5272052e7238be66431e1d1b3e7d2faf996c701ce576cce74290

  • SHA512

    fae8a171467bb1e33f4920f93a9defdc5743d478d5c90446b43132ea1d45aaa7edf1ebbfce4b8ed27a8a70c9197492a4dc7694cf2a411a46f563b28dcd5668c9

  • SSDEEP

    196608:ISHBLJKbIWxA63vYjVQ4SvrOXvH0RG1jT7ub1EBKnQtD794BYb:FBVKNAGvcmTWUc1jT7FKnyJ

  Score

  10^/10

  xwormdiscoverypersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2