Extracted

• • Target

    FullOption_2.1Xenos.exe

  • Size

    4.0MB

  • MD5

    c442a9b9299246b2e5683641a4341641

  • SHA1

    31f41c27ceacc503f33ea72c1ac7c077bc5d9235

  • SHA256

    dedd4c249a6a78e8e2603e7bf8227bbcd1dcca0e0f272ec204cf4a1a61dae7d9

  • SHA512

    fc605adcf43c6f4ae4b4903cf1ba43bc447ddecbbaa8e412845b0ddfee4b36be55e32b42b3005c7c67bb59f5f2a4c9271baa97eb497c4998883f7e69ec8bdd36

  • SSDEEP

    98304:mer3mJdJ0Gz+yQ3zkgHC3lD1qhPEeXkZGRaGxOJx1/q:jSJdJrz+yOkg8BQPfXYoI1

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1