Extracted

• • Target

    RdpHolder.exe

  • Size

    66KB

  • MD5

    0cec61142ef661a4d438f9fc829fe2d4

  • SHA1

    ad059f47e9c804fc4ba5d98b1e787971afa8dd08

  • SHA256

    8e8d6f07eb61ec1f1519723d2f71ff6f774b09bd4a3ac6403605d0cb9614a997

  • SHA512

    cd79f3f8f9f1fe2263ab79b3972473d76a81c2b807a3937b52e12e69c9b2a13fe100dc3ede9039f9bcfbc2e7c3c23c0ca957e9edee4bd47aad0b36d529a270c9

  • SSDEEP

    1536:TgQa5uZDTELCbzOvKnqYi1M4iL2wzJvYchw69+I:BZ09vsqY8M4i6oJQchw69+I

  Score

  10^/10

  xwormdiscoveryrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2