Extracted

• • Target

    Output.exe

  • Size

    883KB

  • MD5

    968a96a052af886b1fcec09332b8fb17

  • SHA1

    c753cb113ae3d58ecdb1681b1297f14452c4899f

  • SHA256

    71fc9d8209f82b251fef2fdeee9a441a739719e5fe66c12883e67b8381f8c11f

  • SHA512

    63483c9b1f1398bd621fb4983ebbabcb33368aa312dabce2db7c1bace15eba4db9609742c8f4b7e0daa769de0a59ad9883e7010e06c1fcb34d722d488a5b4a91

  • SSDEEP

    24576:OSAf8tUxkKfeR40FLYylkHD6kAhgJY9roBpbO7Jf:kOUx8RF/lkjqhg/Da7Jf

  Score

  10^/10

  xwormrattrojandiscovery

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Blocklisted process makes network request

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2