Extracted

• • Target

    t.exe

  • Size

    28.2MB

  • MD5

    32537fc4fb43f3e452ebc55efa9c009c

  • SHA1

    106ae40680c3776de02ab2af413f6514d72c600f

  • SHA256

    6d02f6dd58e131cad086c3366a6e75bec7dc4a18c1caeb509c14f5b6e5a175b6

  • SHA512

    4769bce8d9605ca45611d0cab7ac9df257e677b6c70c1610a8a0bd85393dff80fd3e9c78b72654e6b316e4e5885694e62812fd3bf14b8a5908b791ab46005745

  • SSDEEP

    786432:Ntu0coshxWHVn6s6b64G71jaoCo1Ha2XykT9nCnx89f:bu0jyC6Fb6V71JCo1RjSG

  Score

  10^/10

  xwormdiscoveryexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2