Extracted

• • Target

    Output.exe

  • Size

    160KB

  • MD5

    11470d4ddc09aef2e2f1d267e769ab01

  • SHA1

    471bd5bc159c457d99310300c5721c46391c42b9

  • SHA256

    9c256e20d9183fc4b7aa42014223db21c1086ec4ac90d100f7b4d98cc60f68ee

  • SHA512

    4f53d0084f3b1db83afbe82882591d0c4026c64edd30e81f11b2a0592571e4fcf740323eb978a74d0940a2063146147c3e57b15339e9cc7c238350028a9e1d73

  • SSDEEP

    3072:rp/WlSItg+6kpbx4MIHw5dZtz5h79NR5b:rpBItg+6kpFp621p

  Score

  10^/10

  xwormpersistencerattrojan

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2behavioral3