Extracted

• • Target

    ashbeel.exe

  • Size

    82KB

  • MD5

    b6a12c8b32df34c2aa3fbafcab492aba

  • SHA1

    02d49759282d72e2c55277c802ea531394d6c602

  • SHA256

    499c7636df097d93645acbdb4fae234ae8d0a676bb9167d63535169124b08600

  • SHA512

    ed1ed912774b2822848f0d67f06483816023eac524d1e4cf30e57de35436ba6eed8ef16df2533f3440f7fab78661a22627a71c8096ecbf1da7554e56f5246693

  • SSDEEP

    1536:vJvMimNV6OlhxifG9TzWRqZnGX0dPQXL+b1A31U7ey5EaXABOnWqHN7bF1:vNSlhAfgToqZq+b1AC5EaXABOWgN7bf

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2