Extracted

• • Target

    TrumpWareCracked.exe

  • Size

    1.5MB

  • MD5

    e93c683c91accbed9badc10aa9ec5ede

  • SHA1

    0204ba8fd3bd82277edfec5278174fffe0f87b69

  • SHA256

    cce8c96ff44ec0460c63c2f98174d93d816c1bc34084b4de954883509c136cb9

  • SHA512

    097c7afcfd3f639dcd321698deeb338fab694b771a8bb0daf9da82bef523ab413a9fcfabf96a3e9b6bca7c3883aa9c1592c0c5e74d2b385b4718b6336a5e77ec

  • SSDEEP

    24576:Mb7wuqCqK3Gt6UGMSqH5/92yltT+20ZYOiGZujKRdKvVLu/mEcO:ecuVq88oqZ12uhOiGYO8v0uF

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2