Extracted

• • Target

    15415145.exe

  • Size

    59KB

  • MD5

    6c091ad6fae0fa76f44870d1a1b05cb4

  • SHA1

    040f60c0ee3f4902f919025057e34ab4d11b1abd

  • SHA256

    c352c942b6df33510094c7100fb9d48e36b8e1e2af40a60ccc360b58721c2390

  • SHA512

    3a414f40f99e5847d9631c4ac1143c76e77db7ae42dd8c7aed2ebf1742ec73bb802d54d6cbde3b04f6b894a4cf731aa4e9dbad95166bade13f787b489d8e8d86

  • SSDEEP

    1536:skyZtyUQ8sBkROLW+UzbTH3gfm2qt0OgSko7:skItfQ8sBkROUzbTQf+6OgK7

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2