Extracted

• • Target

    XWorm V5.4/FastColoredTextBox.dll

  • Size

    333KB

  • MD5

    b746707265772b362c0ba18d8d630061

  • SHA1

    4b185e5f68c00bef441adb737d0955646d4e569a

  • SHA256

    3701b19ccdac79b880b197756a972027e2ac609ebed36753bd989367ea4ef519

  • SHA512

    fd67f6c55940509e8060da53693cb5fbac574eb1e79d5bd8f9bbd43edbd05f68d5f73994798a0eed676d3e583e1c6cde608b54c03604b3818520fa18ad19aec8

  • SSDEEP

    6144:4FErOIif3RzSHh+20lXs1TzCeBcQeDbNlz7:eEeR52bmeh0n

  Score

  1^/10
  behavioral1behavioral2

• • Target

    XWorm V5.4/Fixer.bat

  • Size

    122B

  • MD5

    2dabc46ce85aaff29f22cd74ec074f86

  • SHA1

    208ae3e48d67b94cc8be7bbfd9341d373fa8a730

  • SHA256

    a11703fd47d16020fa099a95bb4e46247d32cf8821dc1826e77a971cdd3c4c55

  • SHA512

    6a50b525bc5d8eb008b1b0d704f9942f72f1413e65751e3de83d2e16ef3cf02ef171b9da3fff0d2d92a81daac7f61b379fcf7a393f46e914435f6261965a53b3

  Score

  1^/10
  behavioral3behavioral4

• • Target

    XWorm V5.4/GMap.NET.Core.dll

  • Size

    2.9MB

  • MD5

    819352ea9e832d24fc4cebb2757a462b

  • SHA1

    aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11

  • SHA256

    58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86

  • SHA512

    6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a

  • SSDEEP

    49152:ot12Gb/hz7ZsK9qY5uyUW57VC4IB1+fXhQ1hyCzMw/22fSg7gjxhUE/nbTC0xemh:oLbteKb57W1+PhQ1HM1gmJ/SZmh

  Score

  1^/10
  behavioral5behavioral6

• • Target

    XWorm V5.4/GMap.NET.WindowsForms.dll

  • Size

    147KB

  • MD5

    32a8742009ffdfd68b46fe8fd4794386

  • SHA1

    de18190d77ae094b03d357abfa4a465058cd54e3

  • SHA256

    741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365

  • SHA512

    22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b

  • SSDEEP

    3072:k1GmgYqIY/0YSDBRGlDUqL63budipxj64m8HWYh3vHbFwMhLJSb+:lIO6rGloqL63qW62lJ

  Score

  1^/10
  behavioral7behavioral8

• • Target

    XWorm V5.4/Guna.UI2.dll

  • Size

    1.9MB

  • MD5

    bcc0fe2b28edd2da651388f84599059b

  • SHA1

    44d7756708aafa08730ca9dbdc01091790940a4f

  • SHA256

    c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef

  • SHA512

    3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8

  • SSDEEP

    24576:FIVZLRYIVQd9INo3FDbWX7SsOobBTEAjg+m+ZFNwaxwGoHQ/jzK+:+oWodbi9XFEAjg+m+ZFKaxw

  Score

  1^/10
  behavioral10behavioral9

• • Target

    XWorm V5.4/IconExtractor.dll

  • Size

    10KB

  • MD5

    640d8ffa779c6dd5252a262e440c66c0

  • SHA1

    3252d8a70a18d5d4e0cc84791d587dd12a394c2a

  • SHA256

    440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2

  • SHA512

    e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32

  • SSDEEP

    192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl

  Score

  1^/10
  behavioral11behavioral12

• • Target

    XWorm V5.4/Icons/XClient.exe

  • Size

    162KB

  • MD5

    f5f1d328ac2502686cd9a12b936daa75

  • SHA1

    d8a6c77022d413ddadda8036e41ba803b0664efd

  • SHA256

    2c177b01f77136c9f18b106a80d9a8cbe95e8232eeeac1df7061eb096cdd4d56

  • SHA512

    0c215316df54bd82a7997f3a841c83f72751efa1eadb6c7d07ca624a0a59c8217dd54e4a3de498b8d1b23cfcb99a4179163545bd2720cd3db1d6610f521dfb27

  • SSDEEP

    3072:TZ63JEGojxvVMnbO6uhzfrOxGkBz65/M6If+3Js+3JFkKeTnF:VUJVC9qbGRexBt25

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral13behavioral14

• • Target

    XWorm V5.4/NAudio.dll

  • Size

    502KB

  • MD5

    3b87d1363a45ce9368e9baec32c69466

  • SHA1

    70a9f4df01d17060ec17df9528fca7026cc42935

  • SHA256

    81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451

  • SHA512

    1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7

  • SSDEEP

    6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS

  Score

  1^/10
  behavioral15behavioral16

• • Target

    XWorm V5.4/Newtonsoft.Json.dll

  • Size

    695KB

  • MD5

    195ffb7167db3219b217c4fd439eedd6

  • SHA1

    1e76e6099570ede620b76ed47cf8d03a936d49f8

  • SHA256

    e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

  • SHA512

    56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

  • SSDEEP

    12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/

  Score

  1^/10
  behavioral17behavioral18

• • Target

    XWorm V5.4/Plugins/ActiveWindows.dll

  • Size

    14KB

  • MD5

    2d74a69954a3820906f93ee046b40a59

  • SHA1

    d922a416bae6cb59089608f04d019d079cf23b8a

  • SHA256

    f530a53f1ce49843bbeb048f4096430570a8fd030463edce36737ccdf8b37176

  • SHA512

    1c24b77301b32167969c64da76f063c36e6378bcf4bb5b9d7643f52cabcf870785cbffb5741562317c3eb108e51e36b8323c577f1d24909e3c41026fcf69bfeb

  • SSDEEP

    192:gpsFElxHxzCXorWcsvaUJwfdBuo1I5+3gqT8AO1tW9Yr6IW1GXZ3+eh7EDmSLOb:3FELRzbrUw/AodT8ptsY7XZ3rED8b

  Score

  1^/10
  behavioral19behavioral20

• • Target

    XWorm V5.4/Plugins/Chat.dll

  • Size

    18KB

  • MD5

    09b960e3a849587c5d89112995dfd241

  • SHA1

    2e5bd075a353d9fc5ae88792cb9fd1562ae860ac

  • SHA256

    dadf14dededd77b5535552072038ddcc6e53180479238035f69d8732dd975b9d

  • SHA512

    3b2afa3a1d2f37e7050f7534cbd47ebbc32333dd9da54187d7740b9e11ed61e2538761eea0c93d8fdfa9cf5d1f8d3e8fcb96bf76d2413c16b3940ed6f840ed9b

  • SSDEEP

    384:UUeRbCtl+SLFxdQ0C7sKmsfcrwTKvh6GIKoIYfWUWmf9:j4SpxaoKmJr0pIYfWXO

  Score

  1^/10
  behavioral21behavioral22

• • Target

    XWorm V5.4/Plugins/Chromium.dll

  • Size

    32KB

  • MD5

    5364c989ee142f2a8eab2019ef924806

  • SHA1

    64d7e7f0da0a7b03a17206acc30f477986b25b08

  • SHA256

    9e6227794be4f0e2538c7fa8e36b59642bed88c6ff522733d775c4d121eb3d59

  • SHA512

    7e4a8ed65b9ff757c09657ed797a1360bdf719b2e12aa4b34d9caf445c376a20e6b9fefeb408c787c5ae2a5343e17696ab7847d62458a54b23e5b6a7aa6c55bc

  • SSDEEP

    768:zSyQlmUmBlEu9CgeiFTxL4k4Ir8rQURRgs93AWAjYLvdbKhJ+GHq3ZsK5frq:2yQltmBlPCgeiFTxL4k4Ir8rQURRgsKd

  Score

  1^/10
  behavioral23behavioral24

• • Target

    XWorm V5.4/Plugins/Clipboard.dll

  • Size

    14KB

  • MD5

    a0fc91744b515085873af5734df02f69

  • SHA1

    e001d0618b50dbc4f1b73ee92d910547ded04c5b

  • SHA256

    f63b283387eca8efb8566caa35a258e56a1f0e918e1c6e66d4661e93de97ec30

  • SHA512

    4322e4df41ccbb1550343bb38ab7f5bd62e64426654caacbfe932071d4d5ea351fb0b7cb0b1804d70c21c757d2c277317c74984f4eede40928d37d9639beaaf4

  • SSDEEP

    192:F+e2PZKYnw/LzXsJ0zzBa70OFXgNTer149iY6IW1mX/60FzCCWk7RSLWMU:/2ZE3sJ0ha70USTe5Wi2X/6WjMU

  Score

  1^/10
  behavioral25behavioral26

• • Target

    XWorm V5.4/Plugins/Cmstp-Bypass.dll

  • Size

    11KB

  • MD5

    cf15259e22b58a0dfd1156ab71cbd690

  • SHA1

    3614f4e469d28d6e65471099e2d45c8e28a7a49e

  • SHA256

    fa420fd3d1a5a2bb813ef8e6063480099f19091e8fa1b3389004c1ac559e806b

  • SHA512

    7302a424ed62ec20be85282ff545a4ca9e1aecfe20c45630b294c1ae72732465d8298537ee923d9e288ae0c48328e52ad8a1a503e549f8f8737fabe2e6e9ad38

  • SSDEEP

    192:KpXpS1QWlPkiqdE7FNNGGO9mWbpGkjgyaYcIW1vr/8TNU7aL7YiLsO08hdW5:Kp5IfL0mWbEkUyaYir/oNJL7KQ

  Score

  1^/10
  behavioral27behavioral28

• • Target

    XWorm V5.4/Plugins/FileManager.dll

  • Size

    679KB

  • MD5

    63af8d0f4dd64bb8fd9c5e743cff3bb9

  • SHA1

    304a242f28018fa14c457ef965b84bc192a03760

  • SHA256

    eb2275b4ca61994eca25c9f6b90ac72ea267abab6d940c0a501cfd6695e3792d

  • SHA512

    1c3ee740949b387226d60ca68498e43a3f4d357c4c9724f443519f0fac85f1870d20a507d8c0b06327fc606d1ed2676d9c488bd8bb66428b888837fd0b922aa8

  • SSDEEP

    12288:P8b+nFeDTzZTmRwm0G/Ot69fN0RXwPgnOIMJhnWkhr48vR:UynF6mRwm0G/Ot6910NwPiOIMJhWk

  Score

  1^/10
  behavioral29behavioral30

• • Target

    XWorm V5.4/Plugins/FileSeacher.dll

  • Size

    478KB

  • MD5

    63ce59d68b08598881688f4b6f87e597

  • SHA1

    036dd20d6aebe30056da2eff99c35eb6365bd55a

  • SHA256

    7ade8f9cc008d40848e9ce875c73e018a052a5e8cbe039efa2081a41bc3bcbd1

  • SHA512

    fb1b2ddd4ab370a678f51ef0c12e691f60e59ec1636ea709c1388569bb2d58da07a0ea9bdbccd5b492cd496b2fc081952ee5b5e1a6f13e8cbe65ee5eb737b653

  • SSDEEP

    6144:188L5lWTUVRTw/l97teGtSV41QJDsTDDh0Yhe6dwxLV/tuhgpn5AWRBI+WR:6zTUVRTw1lS4Ys50ie6Cf4gpZs

  Score

  1^/10
  behavioral31behavioral32