Extracted

• • Target

    XWorm.exe

  • Size

    140KB

  • MD5

    ce59cf3857c092e27de6dabceb157d09

  • SHA1

    04b60381eec2a1f90eac81607c6467274b4b5d9a

  • SHA256

    dda2cfe82f91fe2b329ca75917fcc21f39049608ec0b3058cebb86b0d1c8198b

  • SHA512

    6d727f5587350cd6d9823feaf870ee32883b6cfefcb35d36dc8fd198e4a87069cf4e51d4c9e793d86d255d21724cdba9239986512edfa69149c796f5580b233e

  • SSDEEP

    1536:PcGNovtlF8/iEJIkOPwl02biqfbZWq1baS9moy6gcmgOYY08TsEEqmyVttdGFQer:0GNyjWZ99bZZT9ufgOz08TLEqmyBer

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2