Extracted

• • Target

    CHEAT NE PIZDI.exe

  • Size

    197KB

  • MD5

    48c8a6d100fb89f92a8080697133d77f

  • SHA1

    19c8b82c1164575b88abea63cbff500fd5ec26b7

  • SHA256

    622cc6e79e17696dc0c8a621677765cabe8b48ce5d40881bf71b463223e16364

  • SHA512

    e440057421e96a2ed3043a828ffe9b0738c1c532d9bb63d214e8809a1e2d779e38e2b0cab3f539acac44216753fe7b47f8109e5ec7578873f6efc7a150630549

  • SSDEEP

    3072:Yd9xkHFE9jnOjE8SKfbzxcwg7es6/Vsb8VKTup49oJMfF/H9N3Ky9NzLnj:Y6E9XUhcX7elbKTuq9bfF/H9d9n

  Score

  10^/10

  xwormdiscoverypersistencerattrojan

  • Detect Xworm Payload

  • Modifies WinLogon for persistence

    persistence

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1