Extracted

• • Target

    Rexon-Paid_Executor.exe

  • Size

    1.9MB

  • MD5

    767e47b7200526d6d7b9f82d7d350523

  • SHA1

    7c3c57726639fd44cab7a0014e5cad278386cb6f

  • SHA256

    463d3278d31d58a43d7ee5716fc7040ca7f454778ff82595ae67e416a7219b0d

  • SHA512

    a467c77065293aca2c6bebc3c84c6b5584bd808cf7c8fe53794f02224a401eaebac7b7255ae1ef7081bc17b57abd1116e47a51b87b0f02bc41668f702da139f4

  • SSDEEP

    49152:ZCCiwOpZt1fyR59Z48fjQs9vlaEaBf6xxCWFWV/:gHjpAfrQw9i6xIWFc/

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2