Extracted

• • Target

    0240fc167d3e9cabeb5a9e707ce52d7842e332e084bef5e22b72fc3ecd3488c0.exe

  • Size

    78KB

  • MD5

    959ac550de9dc34474a8d8b16a050cfd

  • SHA1

    d6ad271189c5ea66b6ac3268b18c05fa26b5f0f0

  • SHA256

    0240fc167d3e9cabeb5a9e707ce52d7842e332e084bef5e22b72fc3ecd3488c0

  • SHA512

    2c2d837164824fc1503a022a43793e5586c08d6b6b633e7fe828289489fad4c90a7c0a9fb3f2b6de093e901e9b957670063107b06b1e1ea474335806955ab735

  • SSDEEP

    1536:HBx2Kk3000uEZf4Tl+XbctEjt8Y50vuzsB1nKzvpmvqmUte4xRZ4T:H+LE00bZ2leMEZlmBIvh/XZ4

  Score

  10^/10

  xwormdefense_evasiondiscoveryrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1behavioral2