Extracted

• • Target

    Test.exe

  • Size

    35KB

  • MD5

    d9f7d40c0e22fdc4f8518d2ed3e4001a

  • SHA1

    6ea090b74fd1482d7f011a887a0fe5e5dafd6f15

  • SHA256

    7972518318564485281ec23869564b0781ccc7115674ff6cab61d328683aec71

  • SHA512

    76b04dfdf8bd0e390d39a916a97260811bc3f34d151395889b3ae42ad05c9ee4abb24e542f86995175fc1820447451d256c58845e189900196050f938060fbd5

  • SSDEEP

    768:pDMfF7zLKYs2Byj57uddqL79Fk9wlO/hC/22Y:pkF7HKYs/1Ed0Fk9wlO/gu2Y

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2