Extracted

• • Target
    0e9ebfc28035e8809b77187fddaaf394e1ab944d1a503abc424f66bb38a684db.bin
  • Size 62KB
  • SHA256 0e9ebfc28035e8809b77187fddaaf394e1ab944d1a503abc424f66bb38a684db
  • MD5 879e7424b059a8ecf591bb35a8d54954
  • SHA1 a64640055d319d39ce0e9e67d6fac5176cbdf10e
  • SHA512 500d3cd4620805eef2939b3e508b52a6adef3ad99482736f395a1c2bec6cfa8b64c7790e4903c607c8efb3979c5991c91bb59539647a5f5a750e3fab43bff597
  • SSDEEP 1536:7J7VDdBrekFjUECsskbHlZw3iYid6O8o:79VPakO7kbHlGi1d6O8o
  • TLSH
    T15D539E18BBE64225E1FF5FB51DF16222CA79F2235813AB2F64D4028B1A2368DCD417E5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2