Extracted

• • Target

    tmp

  • Size

    95KB

  • MD5

    c83359f746eb240727873f83f3881db0

  • SHA1

    d2bf8a67d2a29e8a48ad685e3e586fde9a7e48a6

  • SHA256

    ee7dd18f59e73fc4569a7a2564d52d6ee55b19757f89f57b17e35f32eb88327b

  • SHA512

    00c30f2c9e38b7b09be0e7729d70803c7ab7d3b9e6b29592119050319b176ba0ca6b79c513c3afce1de025a968c5e278468eda9ccdbe2a9415635a68e715b05a

  • SSDEEP

    1536:n1C8TP7w1ZJFfw9VGzlxjrR751lNz0UCdkV/L7e:1CaP7wHnfw9QxlN5T6

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2