Extracted

• • Target

    q bat 100.exe

  • Size

    643KB

  • MD5

    5a25988847b99240c964b6d9bdac7529

  • SHA1

    9a8f3d87a77798f942a22a6330f6a626f550f32d

  • SHA256

    2982fccb1013ee500aa3c03e0d0ddffd75b1dbe1c1ded02b92552cf68cd2bf1b

  • SHA512

    0908c05925b7d396273007f70cc521354b4a72026445e884d10e69b65bdf170e4853bdb88b33ab074359190f65db79864b3efeeeb36a3865060f291ba667e817

  • SSDEEP

    12288:aQCj7bFg/eIIzGkWX6/6oh8LPVw9u4s+IHYWzOtTy2Zv+HSk1qEtH:IfbFFzGkWX6/7ow9bs+lWz+RZvlkEU

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1