Extracted

Extracted

• • Target

    Binaries.rar

  • Size

    1019KB

  • MD5

    9f0a1e5448e276fd9a1868b08261b258

  • SHA1

    bd0e596a0dacba429edc5d06ca23df7a6136682e

  • SHA256

    5d112a86cfba7fc6a1a176b08fb203eb98d103ba95f9edf6adb72c70558f0c96

  • SHA512

    3a81021e2bff42b1e861d791c9f9089853b5d8e44a8b12aa3f2018a6eba55ee3de3f744c75e2021f6570f7712b1dc1589ff1aa52a4804f02f2111dc3de0a2d52

  • SSDEEP

    24576:uc7mwB4VdnJuGYlLS1GmezoXZUnfG4vLjcl7FpOR5wG24q+h:cU4TeVqaoXO+4vv+fORR24q2

  Score

  10^/10

  metasploitxwormbackdoorrattrojan

  • Detect Xworm Payload

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  behavioral1behavioral2