Extracted

Extracted

• • Target

    XWormLoader.exe

  • Size

    8.2MB

  • MD5

    b545d6f6bb0ea7b613185e9b6108c54c

  • SHA1

    7228529c2b7527004b34de6406ac1c744f35f434

  • SHA256

    a25f014c881f4e00db371fd0da081542d14d72311c86b7ad908933a9ba3269a0

  • SHA512

    0807e5e73573da08eb562fd73022c7c44d88c3ecf888086ab52257f491c717deb058fae0b0185de5db49de6158783d25c37db2186a61f18059e4070a4abe667c

  • SSDEEP

    196608:C58t3afccVSE+mfkSV6qfwI7fRxzpkhuUgF5ioK:CWt3afccqmfLh7pfdF5iR

  Score

  10^/10

  blackguardxwormratstealertrojan

  • BlackGuard

    Infostealer first seen in Late 2021.

    stealerblackguard

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2