Extracted

• • Target

    NLHybridInstaller.exe

  • Size

    2.0MB

  • MD5

    cf7734eb96e90bb9beb67c4cea3c3c2c

  • SHA1

    1695cc75145439634e1beb3b6b568096f0474239

  • SHA256

    c5fc6ccc1b183c14888a0a832a52ea7ee37efa0e84f6712aae56101c48da983e

  • SHA512

    338ec39d7146e5451acdf563db88df0affda014f67a0fcd012b8e3e3b7a7aa97dc485a3bc2d31dac23d7cac286d7341a34ddd3ac7f1d6d78d5277e2ee6b1132a

  • SSDEEP

    24576:HawwKusHwEwSDMn64+uT361idUSeMITCqgcfyr4Py6K22i+i8rtVs1ZY7jQY71M:XwREDDMcuT36AdHeMxWrP+beY7UY71M

  Score

  10^/10

  discoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2