Extracted

• • Target

    RealtekAudioDriverInstall.exe

  • Size

    34KB

  • MD5

    c08e200e9b6243e0af193b2427897b24

  • SHA1

    6253cce0f986fab471cb8d877b21773cac468e2e

  • SHA256

    a03d5af3b1cf34ca72c56d567f78153eae51bb0c29ba8c045c503be0723dffe3

  • SHA512

    6d0f18a531128497abf1c947daca06a7ab8f0f242f31fc4a6f73dba0e336337068f0eb86ea2e675fa4bbbc4e3994503ea00f393beda43dc281e5ae53f2abc53e

  • SSDEEP

    768:KHqIHRXYazPNhzIgtoFk9Fy9YBOjhJ/VcP:KhxX9z0gtowFy9YBOjXtcP

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2