Extracted

• • Target

    a231145abbb216fb9ad0bb81c51832f5.bin

  • Size

    92KB

  • MD5

    a231145abbb216fb9ad0bb81c51832f5

  • SHA1

    c93e051e8c374bbcb153b1862e6e101abb73775c

  • SHA256

    305817d3405f3f1d344836b74d5e04af40da8e11d5334c6401c94a3baceb34ea

  • SHA512

    3c67f60a04495fc14b3bdacf6d19a509c13dddcf29227696d69336878f3059bc33eb6a2183d12fd6a88c8fe0533c0787eb9599686564c061e3d500b1d34c3fcd

  • SSDEEP

    1536:jynazMODiSbl57b/4tXzQP8AltrOSWht1s5qXxx3M9H+NjExnCMT3JuT+d/1SWPO:jOa9Dnv7ba85OTt25x+Z6Lh1ZP/Bjvfs

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Modifies WinLogon for persistence

    persistence

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2