Extracted

• • Target

    sexclient sieg heil(1).exe

  • Size

    65KB

  • MD5

    446ccea41c7662e0e5e42b8973dddf6c

  • SHA1

    d7a1fc984fe343bc1381bc1fd8193b849fdf0066

  • SHA256

    3a77d5cb3177ac53062c5cc0dbdd844efa661c567588a62a3ecd2114f07ce22d

  • SHA512

    2e36d6da44e0289577dca728c5c734cef5a0f94e7fff5447fb6739a9855013f20a2a015a7fcc021870ff54f20ae24a39691eef5d0ed35ccd73471076edba741c

  • SSDEEP

    1536:oeLK+ZR+gq5PTEVjP+b94PItjHPpjBRqFP9OTUF:hvZRhVjP+bqCjHPpfqTOTy

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2