Extracted

• • Target

    mmmmm.exe

  • Size

    650KB

  • MD5

    0ec384b7321f9f1541c1bc606174ece0

  • SHA1

    50a80a859e24aebe6dfc4d0b87fee07874b41bd0

  • SHA256

    9e8ba783a127bc7bcd386673131e370b1fcd5367d28a002e244b0094c0bd7b5a

  • SHA512

    3365865fb6c56f3ba12c7366afad8dd68af859c3886a3e7c589eaa6b6725cc7423106dc4f64a2e56e7e248004faf05dc0b99baaed01e739a1ed9bf01bbf6bcee

  • SSDEEP

    12288:oCBUW9ge15I4ScpG1Im6wPeVdtNuxjAYVUWAJ:oCBUKd5Pp6QwP6jw

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2