Extracted

• • Target

    dbgtest.exe

  • Size

    2.0MB

  • MD5

    5d25e60bed5aba0e6efa612900aa0e93

  • SHA1

    bd0f1e14266e557ceb700b2edc14c20fea0d6148

  • SHA256

    e1ec71b442828928a51c9999db39fb3e3a299bc0abe1a3efc08337ef6f70b491

  • SHA512

    963d402b04088578b9ce3870579f85168282b44062d60d08f2382dba6aa9b5811d542925e837827b7ae9417144e09b04f4ea03ad849b65082f91377291da9a09

  • SSDEEP

    24576:2B6j6meQdxUdZjtm7Wi3TUxk+6c3gD0uvUz4n+qsZUnKxRWxRAUGCw1n7JvXDeZe:v7WhZ6W7TcntsvivNE

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1