Extracted

• • Target

    a824b4c803a61ebaf24e143a1deeda52c549e7e8df9ab6bd25a94d9619b1cb36

  • Size

    343KB

  • MD5

    c46107c429621e50d0745fdde89b9b2d

  • SHA1

    38c028a96e01b34665006d44a467f7440e00d91e

  • SHA256

    a824b4c803a61ebaf24e143a1deeda52c549e7e8df9ab6bd25a94d9619b1cb36

  • SHA512

    403cf1d225cb2b91f584303905eed039651aaa9b420350444872515f3d75d1e52299cb303293140f705fae0a21381676ea2aab0785f592c205c10df7b7bffe65

  • SSDEEP

    6144:eN7qJda/YlTDtfA564CZzyiJTps3n9d5F3lUtZWxc6+C4pMFqm:YsaaDf4CZzyiJszaHz6K2

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2