Extracted

• • Target

    allah.exe

  • Size

    67KB

  • MD5

    801bcacf5ee72a5871d43db2bbe67c5b

  • SHA1

    8e8820be0eac81b28b1c56c091511c31a872e045

  • SHA256

    d1fa0a10d83aeb69a4142815522c9ddd6b74dd761661ff60e169b58439098b0c

  • SHA512

    2e145f53af0d1922f16bb09666ab2d1355fdbd418559c758e72e642614514f0635847e34d588d992d5999cd17230ad4d248bfc4e04fe36379ffccc5fbeed3065

  • SSDEEP

    1536:hh8tOfil285SO6XSfQJWJbiW+bz1CgLCy2sm1OQIEQMPeSw:QtOS2u4JWNiW+bz1CtOtpbT

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1