Extracted

• • Target

    Fyz.exe

  • Size

    83KB

  • MD5

    f1f85fdacfd295faf64fb7a23973cd49

  • SHA1

    ebdb5b3687670aa3f64fab82558f62b4190daf4f

  • SHA256

    75ec0944508969faba292ea85974baa5880f95100280851592615d1befd24513

  • SHA512

    3fdf6627a2758a77e6dd2f1164764491af4402a0463edf60dd7c6d436fc0484498226e2408770fbcf44fe72b1b1c0685957ab56a3083729bf5a5a9d1acb2deef

  • SSDEEP

    1536:VgXeoVUIzfmssAhUykfv6QZslxxctjAHmSu0ADfI/e5VihgvsMnkJ:VgXFVUIzfmGULfv6ucx2E0TfoTQkJ

  Score

  10^/10

  xwormrattrojandiscovery

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2