Extracted

• • Target

    Gorilla tag.exe

  • Size

    429KB

  • MD5

    a47502d0bdaa67d14c762565ee7864d6

  • SHA1

    afed9a6ac84e97bbd2dc2593ff6204716e696695

  • SHA256

    20ba1d60db4e5d51a698d7ab07e8a5dd75cd6aaae792c76dda315d757b9dfdde

  • SHA512

    dae6c201c878da5438a58bc6258cb7287ddfbf002c01c0a13deb4039a4fe5e8a85be04c57367f56de4ac26ae0a3fb0d166b27e06de354bf3b2efd38af5c636e9

  • SSDEEP

    6144:BkGb8qJ+GIIIIIIIhIIIIIIIIIIIIIIIUz9bfF/H9d9n:BRC9

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2