Extracted

• • Target

    tmp

  • Size

    235KB

  • MD5

    715d9e1786839981fc5aa6ec4c9df1a6

  • SHA1

    e4f3d03f3e92faa404669b55c7c28aba157a44ac

  • SHA256

    9d4991393962992db54a17e7aad1152a8965c3d51ac309d35768953f7e20dac5

  • SHA512

    be181551a7c705e9b18c812defbc86790bd32f67da474e61dd07fc8cd36030b58e7cf908a1db2fe826ec0ec8ed3d08c0b42bda1a8731213424ba7e5ef477c534

  • SSDEEP

    3072:FjToRFRb8MPOin68SKfbzxcwg7es6/Vsb8VKTu549oJMfF/H9N3Ky9NzLnQ:2RFRbVX6UhcX7elbKTua9bfF/H9d9n

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2