Extracted

• • Target

    Xworm-V6.1 (2).rar

  • Size

    64.4MB

  • MD5

    2a3d4e25ed01e9585e5ab5826a6a4111

  • SHA1

    0e51faf8e51e640f0efefa4d5deba896f88f0f49

  • SHA256

    9b56ee6ee5bb27b038df82d0ef4f03246e0449515f3b6cfb47155ca5d80d0a5a

  • SHA512

    d6b4e7763238210e07e80d89da930de85c070ff90a2f39b9c713aea12927426161a3f7341c8f693000455f9ef60377e1d4eae02928cc73eaf9bf82c7a4dca7a3

  • SSDEEP

    1572864:s3Umd27Ft310rYwfqtNEs8XLyURiI1wl9Z2fEc9+gjjIWPf1L:skIylLwfqtNEZXLZ4I16mEc9+gjjff1L

  Score

  10^/10

  agentteslaxwormkeyloggerphishingratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1