Extracted

• • Target

    6f29de59bd022c91ea367bf1c0dbe58fb51f410d97e974ddbfdee97ad08b5807.exe

  • Size

    1.8MB

  • MD5

    8bef43743abe0709a6c215e4bd40f037

  • SHA1

    4c87bf94e544db943d7800cab9b9005fd15a15ac

  • SHA256

    6f29de59bd022c91ea367bf1c0dbe58fb51f410d97e974ddbfdee97ad08b5807

  • SHA512

    49a6eb3b8e47319cfc324c034a92e5876443039099319883f9ac7c96ae1642272a0ed9613a753e6f96682f328f4420d4c13361176e16baa9b721d8e53d92450f

  • SSDEEP

    49152:U9vUdN2sefykAtpQdsPMEUGN4+ojfzN4D:yM2XEPQdsPMEl1ojm

  Score

  10^/10

  xwormdiscoveryevasionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2