Extracted

• • Target

    discordnukerv3.exe

  • Size

    35KB

  • MD5

    ec09727a0ebaf761bcaf7c5f3b799008

  • SHA1

    d6aa602f2e7883d0fe79585ddf2093b1b513f05a

  • SHA256

    b412ff0701b365206f9da406214e5dccf883f77a00b750658fad687e95a4e2a6

  • SHA512

    01a113512eaa04af6f2493a24806054bb4050e1273e6fd2eacc86457df0b414e9bdd2f841b040c17cfa2c19244423a262b0a71220e1bb1861148eada44148cbc

  • SSDEEP

    768:mo7zWVFe5fzEky1TxVPemVFyw9brVO/h6yIL:X7zWVFe6Rq8Fr9b5O/oBL

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2