Extracted

• • Target

    pictures and specifications.exe

  • Size

    177KB

  • MD5

    ce901f91244366477cd0b769d92f9034

  • SHA1

    6f49860e768725f78bf3855d18efe329b3553355

  • SHA256

    1b72e6203b4d26cbe44b55e7df27b3477badd3270cf900bb13c2af47bed80516

  • SHA512

    2f94fbd0d733db31c5ad56be18ee53ec6a531a7d7f5bc08f59c1c7f3dd0f5827b9e4dd586b084ac031fd06599510332d21ebbb7515a1441332d1fc11b143bdfb

  • SSDEEP

    3072:5rsawEN2scoJ7FWN3WfHC5kan0r0i4tyAyptWKye6vx2PvLn3:5H7FLf4kan0rBP

  Score

  10^/10

  discoveryxwormrattrojan

  • Detect Xworm Payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2