Extracted

• • Target

    b280b6c393aa68413403f049e84e020ed7ba360bcf27a751bebc43cf5da5aa4c

  • Size

    234KB

  • MD5

    1927a5f9c4dc9980fa675135dc4c657d

  • SHA1

    539199552b8d801266a0d9110af1e7382d6b6b50

  • SHA256

    b280b6c393aa68413403f049e84e020ed7ba360bcf27a751bebc43cf5da5aa4c

  • SHA512

    7922a65ffe9883c2d621318e748efd02f5fe49200ccf66143d5363b21c1ee43260391443dc8b8cc850b893dcdb0abffa52e86c9f396e2867a3bd3816f45364ef

  • SSDEEP

    6144:JNVsqclbIlOsUhcX7elbKTuq9bfF/H9d9n:JNiqGs3X3uO

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2