Extracted

• • Target

    dd.exe

  • Size

    65KB

  • MD5

    3656e7ce0ef34b60dc1312a2f4158f99

  • SHA1

    90474d1c1b69aa23aa52ab848e570a978e0e4ee0

  • SHA256

    0c8d4f1c691321cae119c1b75f442fcd368c72622b44f238c6ffda553ff9532a

  • SHA512

    03894a0b129a1cff9daa8c04d058da83d9df38f0dd7893c533d79ee969b5536ee92611551c25c739a75331f860b88fe5216bdb9f517dcd53886ac2dcb87dccb5

  • SSDEEP

    1536:lEBUcA5UtEa3FwkVaACZa+bmx7xVtOOYAc6uW:K2baHQACk+bmt4OYAR

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1