Extracted

• • Target

    CelestialCrack.exe

  • Size

    146KB

  • MD5

    b9170d37ddb8bfbad5afd93a550232fa

  • SHA1

    8004867d262c27f0b0464f7ed686cac434da024a

  • SHA256

    ca13b369259edd192dad0120a8d267bc9aaa8cbd10232db2f011d7b043cfff32

  • SHA512

    a224e9027049fedffcac56f4cb7f4acb0184c4ddea1f9bf1ed9a03141d06a9ba113f8cca55773932078668ccfc43a5fb20dfd7e5a72d443c0a43c9f5cf507a62

  • SSDEEP

    3072:+tO3dom2hHDOxycn+XnQ5LueGKQGT2XgvL0fSUb6jYt:25mwm+A5Lu3O2XgkSvi

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1