Extracted

• • Target

    xplor.exe

  • Size

    43KB

  • MD5

    ad4efdfce404977b56d0f104188f325b

  • SHA1

    015f68788843c6d8f2d8a89151ae96f19732f506

  • SHA256

    7b6328329414fa681a268fbda25b3ee454bf1dcb3706e29d724d1038c700b9ab

  • SHA512

    1f114d722200bd7bb1b87e487330d7065b4d6da3cfe9f02f699503d263a547857ecfe89cef4e04f6f981af12325863b39aa19b5f550357d35b3aea69f3fb35b6

  • SSDEEP

    768:oIIrUKPPi2ojXLkL+Dj3jV9sTi/UJrOaqBbxA63/nlea:oIWpP62oTLk2jTLsO/mqj/nlea

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2