Extracted

• • Target

    LoaderFuscate.exe

  • Size

    13.9MB

  • MD5

    c07637410f1d07d4fd69030fac313a7f

  • SHA1

    72a944ca04c28d7d651468b082ba1630900272e0

  • SHA256

    7880389d89e8e28cbf6ac18bfb40dc8661dec9d9723e97b14bea6f8dff91804b

  • SHA512

    747ebeceacf1342bee878ca9aa141b3939c309eee4c14dad3c9ab3f5a7affef45adff9ffc88c7e73368eb7fb3239a242845d4acbd3a3cf5ae94f403209d6393c

  • SSDEEP

    393216:pV2YFanmL01+l+uq+VvyUR9LrvF1+TtIiLCS9DNsIRfamd:XE601+l+uqgvyO9fd1QtIQ9iIdd

  Score

  10^/10

  xwormdropperexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Download via BitsAdmin

    dropper

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2