Extracted

• • Target

    example.lnk

  • Size

    106KB

  • MD5

    7700437a5f513b84c95bd3021e9c6eb5

  • SHA1

    197b8e9a62c2d1116934387ed4311d0fa4d972c4

  • SHA256

    22deca7853e87df24e07dda90de8b271c10a1a834071016027bcfcd5e1a9025a

  • SHA512

    c73308cce581200b34d719100fe38001dcf30a6d8d58d1032410679935984d4348292a4c96d21013c5febfa8063a8a9b34ef7b0a84aa809617bfab6306094d04

  • SSDEEP

    1536:aMFdgMwrXpEaDF/iCehwUdIYhojc2PUGbvkLIJ9P2kdHG:aMFdgNXJiCepWYhn2PjbJjP2kdHG

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2