Extracted

• • Target

    PO#GREEN AURA.exe

  • Size

    103KB

  • MD5

    71e0c8f71b15046709d4e250086346a4

  • SHA1

    9536f9bc5e10128074cdd2597e970b29d44c4bcd

  • SHA256

    462e4f6c2647a8fffb7be6a37eca3dfef4051f9f20a5e8927b446d98d1af84f0

  • SHA512

    15cd09125122f6e79bffc9112ee888c4afef515d09a9598da2b23cbc240b043e63f1d3d6538c74fc56cd65eeeb756679f1a4d54dd74e0a026ba80a7999dff2ba

  • SSDEEP

    1536:EfDrLD7tmNEoCfjSbHb7RqWYZvZqF3c9MwsUSEJxY87d17:EHLD7Ewub70Wmy3VwQGxY87r7

  Score

  10^/10

  discoveryxwormrattrojan

  • Detect Xworm Payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2