Extracted

• • Target

    apex launcher.exe

  • Size

    38KB

  • MD5

    7f11a2c12c1124c02d4ae05d748f581c

  • SHA1

    c9a0d0a40d03f0e130c6f3dfd3b61dc76c810bd7

  • SHA256

    ac558d55b305c66a8dce08527dd1ddf929c4a66ee8cc33a893f127e211bc21a9

  • SHA512

    2e54625e5d29aba3f87435e8a2256918f745678c01628dcdd00744f938b6f653e986ca8e1f4c07dcc5f47e05305620b3855c60a436df3f51e0272d676f40f6dc

  • SSDEEP

    768:xtMkC1zgeJoS7o8kel0HfzvXPodTYdk1F5K5A40IbZD+KK:xtMvguoSZn4odTtB40IbZVK

  Score

  10^/10

  xwormdefense_evasiondiscoveryrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1