Extracted

• • Target

    33d4fd69c03968b472e3b5ec2fdf43db754aeed4366ae0111ac97fd394ef1e45.exe

  • Size

    518KB

  • MD5

    d3689c6f5e4336f5c79d3b5ef5588950

  • SHA1

    2b4ec9a97aa03de5c00616b3d4f695377791155f

  • SHA256

    33d4fd69c03968b472e3b5ec2fdf43db754aeed4366ae0111ac97fd394ef1e45

  • SHA512

    0e6b81284abcbe26c821c6ee4f02f7a8933fc1704baa485ddd7a45786a4eb777ecef0df2bee924f1bdbbf70b7e7a88749bc8544109a51dd1ea3116977965af41

  • SSDEEP

    12288:N+2iN/qHSkTkOMBKZ92HV1y4jiXLhT5vW:N+19qHSiZEKX

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2