Extracted

• • Target

    XClivcbcbvcbcvbent.exe

  • Size

    39KB

  • MD5

    a40bbe0710c302b751bac0ef05715269

  • SHA1

    03819c237e82daaaa0171f5e482bf66a4ce3a94b

  • SHA256

    f7b6bae6e4ddaf78db5f4908358030a58ecd2bb24687fe6d1332c6f491eb5600

  • SHA512

    b6e7dec8b7dac422c9b8ec1af50d9b38336c1e55ba156bfe171ec7db2c313c5aad54ee772611bf830580285ab87fa80622814e1f030ad0afd85b7bc1507c917f

  • SSDEEP

    768:5np2iB3sNvzK2AwjzeJYEW7KbiCqEoFN9Uv0OphcjtYGkn:eiB8V6tWlCq9FN9UsOpwBkn

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1