Extracted

• • Target

    bootstrapper.exe

  • Size

    33KB

  • MD5

    01148319be9a54a165bf44620bbe211b

  • SHA1

    800bef6e8365dbc9eb68c825f5b961f06da257b5

  • SHA256

    15c221467ad32d7cbcdeb41674b5701ef155694c420075f7c953b63f5663d253

  • SHA512

    1486dae32b0972ee6c6af10275c3b75c2709448d7b11a4b58b5c041e9d2dd6e1d35f51c5292ffbf0dbc2cd62c1b23aee68dc50abaf6780893c55ece4ac6a2bd7

  • SSDEEP

    768:OqJluIYWuThDo23/nWcF+9HtGO/h1//+k:VJ8ZW4Do2PnFF+9H0O/ruk

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2