Extracted

• • Target

    Enquiry#039855.exe

  • Size

    10KB

  • MD5

    a69ad9d0fb5bdf7ea93dbfca99495d80

  • SHA1

    b3dc5cd3283982a73153e72ec76dd08060f40b8f

  • SHA256

    bad755124567617e4879874ad80ef2a54b6d6bb69c9da57f7073320d91759e37

  • SHA512

    d16faf32a85e68f0d42328ae0163e24a1aaf2538f35de57e2a6524e96be9274a730d887f14d72fe7c9914c4dadcf06f160d7ab95e8f8daf676e508a32c201fbc

  • SSDEEP

    96:YkdSfY8xVcZbqvLV1FKBh1gf4oSU26z2Eg8Qjh0awDabXrVLZD+t8EM/cRV7kPzj:YTvVMuV1o+f4qu8Qh7wDarrX+u/w6

  Score

  10^/10

  discoveryxwormrattrojan

  • Detect Xworm Payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2