Extracted

• • Target

    XWorm-RAT-V2.1-builder.exe

  • Size

    2.6MB

  • MD5

    026ed3d2d6ae234fa25c06f4e4a82f28

  • SHA1

    a90c6b359468d66e3b51628e7bc8a2b2b34e75e0

  • SHA256

    2bed3c930293ef05d2211aa5987a06c26d0fe5289ae529b1fc1cab7787f5648a

  • SHA512

    97e8b6786bf29e3c06dd98c0654660607ecb983d9e00f0d280de0fffdf2d51457e767e6b1b8fc5c0db7562459a41fedeb4b33a1aee7c96838b5644db5aaa8674

  • SSDEEP

    49152:QI5goCONGLDYGbixsnNMJlHazd4wMpzAnhO8IksDJzlmXbOr/L6qYXt1:QAfG/RDeJlVzAnQX4bJp

  Score

  10^/10

  xwormrattrojanpersistence

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2