Extracted

• • Target
    XWorm V5.4/FastColoredTextBox.dll
  • Size 333KB
  • SHA256 3701b19ccdac79b880b197756a972027e2ac609ebed36753bd989367ea4ef519
  • MD5 b746707265772b362c0ba18d8d630061
  • SHA1 4b185e5f68c00bef441adb737d0955646d4e569a
  • SHA512 fd67f6c55940509e8060da53693cb5fbac574eb1e79d5bd8f9bbd43edbd05f68d5f73994798a0eed676d3e583e1c6cde608b54c03604b3818520fa18ad19aec8
  • SSDEEP 6144:4FErOIif3RzSHh+20lXs1TzCeBcQeDbNlz7:eEeR52bmeh0n
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral1behavioral2
• • Target
    XWorm V5.4/Fixer.bat
  • Size 122B
  • SHA256 a11703fd47d16020fa099a95bb4e46247d32cf8821dc1826e77a971cdd3c4c55
  • MD5 2dabc46ce85aaff29f22cd74ec074f86
  • SHA1 208ae3e48d67b94cc8be7bbfd9341d373fa8a730
  • SHA512 6a50b525bc5d8eb008b1b0d704f9942f72f1413e65751e3de83d2e16ef3cf02ef171b9da3fff0d2d92a81daac7f61b379fcf7a393f46e914435f6261965a53b3
  • MD5 SHA1 SHA512

  Score

  1^/10
  behavioral3behavioral4
• • Target
    XWorm V5.4/GMap.NET.Core.dll
  • Size 2.9MB
  • SHA256 58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86
  • MD5 819352ea9e832d24fc4cebb2757a462b
  • SHA1 aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11
  • SHA512 6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a
  • SSDEEP 49152:ot12Gb/hz7ZsK9qY5uyUW57VC4IB1+fXhQ1hyCzMw/22fSg7gjxhUE/nbTC0xemh:oLbteKb57W1+PhQ1HM1gmJ/SZmh
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral5behavioral6
• • Target
    XWorm V5.4/GMap.NET.WindowsForms.dll
  • Size 147KB
  • SHA256 741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365
  • MD5 32a8742009ffdfd68b46fe8fd4794386
  • SHA1 de18190d77ae094b03d357abfa4a465058cd54e3
  • SHA512 22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b
  • SSDEEP 3072:k1GmgYqIY/0YSDBRGlDUqL63budipxj64m8HWYh3vHbFwMhLJSb+:lIO6rGloqL63qW62lJ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral7behavioral8
• • Target
    XWorm V5.4/Guna.UI2.dll
  • Size 1.9MB
  • SHA256 c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef
  • MD5 bcc0fe2b28edd2da651388f84599059b
  • SHA1 44d7756708aafa08730ca9dbdc01091790940a4f
  • SHA512 3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8
  • SSDEEP 24576:FIVZLRYIVQd9INo3FDbWX7SsOobBTEAjg+m+ZFNwaxwGoHQ/jzK+:+oWodbi9XFEAjg+m+ZFKaxw
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral10behavioral9
• • Target
    XWorm V5.4/IconExtractor.dll
  • Size 10KB
  • SHA256 440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
  • MD5 640d8ffa779c6dd5252a262e440c66c0
  • SHA1 3252d8a70a18d5d4e0cc84791d587dd12a394c2a
  • SHA512 e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32
  • SSDEEP 192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral11behavioral12
• • Target
    XWorm V5.4/Icons/XClient.exe
  • Size 162KB
  • SHA256 2c177b01f77136c9f18b106a80d9a8cbe95e8232eeeac1df7061eb096cdd4d56
  • MD5 f5f1d328ac2502686cd9a12b936daa75
  • SHA1 d8a6c77022d413ddadda8036e41ba803b0664efd
  • SHA512 0c215316df54bd82a7997f3a841c83f72751efa1eadb6c7d07ca624a0a59c8217dd54e4a3de498b8d1b23cfcb99a4179163545bd2720cd3db1d6610f521dfb27
  • SSDEEP 3072:TZ63JEGojxvVMnbO6uhzfrOxGkBz65/M6If+3Js+3JFkKeTnF:VUJVC9qbGRexBt25
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral13behavioral14
• • Target
    XWorm V5.4/NAudio.dll
  • Size 502KB
  • SHA256 81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451
  • MD5 3b87d1363a45ce9368e9baec32c69466
  • SHA1 70a9f4df01d17060ec17df9528fca7026cc42935
  • SHA512 1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7
  • SSDEEP 6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral15behavioral16
• • Target
    XWorm V5.4/Newtonsoft.Json.dll
  • Size 695KB
  • SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
  • MD5 195ffb7167db3219b217c4fd439eedd6
  • SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
  • SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
  • SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral17behavioral18
• • Target
    XWorm V5.4/Plugins/ActiveWindows.dll
  • Size 14KB
  • SHA256 f530a53f1ce49843bbeb048f4096430570a8fd030463edce36737ccdf8b37176
  • MD5 2d74a69954a3820906f93ee046b40a59
  • SHA1 d922a416bae6cb59089608f04d019d079cf23b8a
  • SHA512 1c24b77301b32167969c64da76f063c36e6378bcf4bb5b9d7643f52cabcf870785cbffb5741562317c3eb108e51e36b8323c577f1d24909e3c41026fcf69bfeb
  • SSDEEP 192:gpsFElxHxzCXorWcsvaUJwfdBuo1I5+3gqT8AO1tW9Yr6IW1GXZ3+eh7EDmSLOb:3FELRzbrUw/AodT8ptsY7XZ3rED8b
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral19behavioral20
• • Target
    XWorm V5.4/Plugins/Chat.dll
  • Size 18KB
  • SHA256 dadf14dededd77b5535552072038ddcc6e53180479238035f69d8732dd975b9d
  • MD5 09b960e3a849587c5d89112995dfd241
  • SHA1 2e5bd075a353d9fc5ae88792cb9fd1562ae860ac
  • SHA512 3b2afa3a1d2f37e7050f7534cbd47ebbc32333dd9da54187d7740b9e11ed61e2538761eea0c93d8fdfa9cf5d1f8d3e8fcb96bf76d2413c16b3940ed6f840ed9b
  • SSDEEP 384:UUeRbCtl+SLFxdQ0C7sKmsfcrwTKvh6GIKoIYfWUWmf9:j4SpxaoKmJr0pIYfWXO
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral21behavioral22
• • Target
    XWorm V5.4/Plugins/Chromium.dll
  • Size 32KB
  • SHA256 9e6227794be4f0e2538c7fa8e36b59642bed88c6ff522733d775c4d121eb3d59
  • MD5 5364c989ee142f2a8eab2019ef924806
  • SHA1 64d7e7f0da0a7b03a17206acc30f477986b25b08
  • SHA512 7e4a8ed65b9ff757c09657ed797a1360bdf719b2e12aa4b34d9caf445c376a20e6b9fefeb408c787c5ae2a5343e17696ab7847d62458a54b23e5b6a7aa6c55bc
  • SSDEEP 768:zSyQlmUmBlEu9CgeiFTxL4k4Ir8rQURRgs93AWAjYLvdbKhJ+GHq3ZsK5frq:2yQltmBlPCgeiFTxL4k4Ir8rQURRgsKd
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral23behavioral24
• • Target
    XWorm V5.4/Plugins/Clipboard.dll
  • Size 14KB
  • SHA256 f63b283387eca8efb8566caa35a258e56a1f0e918e1c6e66d4661e93de97ec30
  • MD5 a0fc91744b515085873af5734df02f69
  • SHA1 e001d0618b50dbc4f1b73ee92d910547ded04c5b
  • SHA512 4322e4df41ccbb1550343bb38ab7f5bd62e64426654caacbfe932071d4d5ea351fb0b7cb0b1804d70c21c757d2c277317c74984f4eede40928d37d9639beaaf4
  • SSDEEP 192:F+e2PZKYnw/LzXsJ0zzBa70OFXgNTer149iY6IW1mX/60FzCCWk7RSLWMU:/2ZE3sJ0ha70USTe5Wi2X/6WjMU
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral25behavioral26
• • Target
    XWorm V5.4/Plugins/Cmstp-Bypass.dll
  • Size 11KB
  • SHA256 fa420fd3d1a5a2bb813ef8e6063480099f19091e8fa1b3389004c1ac559e806b
  • MD5 cf15259e22b58a0dfd1156ab71cbd690
  • SHA1 3614f4e469d28d6e65471099e2d45c8e28a7a49e
  • SHA512 7302a424ed62ec20be85282ff545a4ca9e1aecfe20c45630b294c1ae72732465d8298537ee923d9e288ae0c48328e52ad8a1a503e549f8f8737fabe2e6e9ad38
  • SSDEEP 192:KpXpS1QWlPkiqdE7FNNGGO9mWbpGkjgyaYcIW1vr/8TNU7aL7YiLsO08hdW5:Kp5IfL0mWbEkUyaYir/oNJL7KQ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral27behavioral28
• • Target
    XWorm V5.4/Plugins/FileManager.dll
  • Size 679KB
  • SHA256 eb2275b4ca61994eca25c9f6b90ac72ea267abab6d940c0a501cfd6695e3792d
  • MD5 63af8d0f4dd64bb8fd9c5e743cff3bb9
  • SHA1 304a242f28018fa14c457ef965b84bc192a03760
  • SHA512 1c3ee740949b387226d60ca68498e43a3f4d357c4c9724f443519f0fac85f1870d20a507d8c0b06327fc606d1ed2676d9c488bd8bb66428b888837fd0b922aa8
  • SSDEEP 12288:P8b+nFeDTzZTmRwm0G/Ot69fN0RXwPgnOIMJhnWkhr48vR:UynF6mRwm0G/Ot6910NwPiOIMJhWk
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral29behavioral30
• • Target
    XWorm V5.4/Plugins/FileSeacher.dll
  • Size 478KB
  • SHA256 7ade8f9cc008d40848e9ce875c73e018a052a5e8cbe039efa2081a41bc3bcbd1
  • MD5 63ce59d68b08598881688f4b6f87e597
  • SHA1 036dd20d6aebe30056da2eff99c35eb6365bd55a
  • SHA512 fb1b2ddd4ab370a678f51ef0c12e691f60e59ec1636ea709c1388569bb2d58da07a0ea9bdbccd5b492cd496b2fc081952ee5b5e1a6f13e8cbe65ee5eb737b653
  • SSDEEP 6144:188L5lWTUVRTw/l97teGtSV41QJDsTDDh0Yhe6dwxLV/tuhgpn5AWRBI+WR:6zTUVRTw1lS4Ys50ie6Cf4gpZs
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral31behavioral32