Extracted

• • Target

    Solara_Bootstrap

  • Size

    701.0MB

  • MD5

    a4dea35bbfedaf715edf928c850f9062

  • SHA1

    9d6fdbd7d96663b54c14182654a4742b11728743

  • SHA256

    e5700337351ecb04be3ac19ab2875a2f810a42a11bc1c3a6cdfb6a20c021c346

  • SHA512

    6cce303a11105bbab1a903549a6a830612b2a642b00d790065143eef5b3e7a494369a7bb330d6cd1a3988e00573d8785aad1a19dff798379b01dd7a8883d4297

  • SSDEEP

    768:t45Ckp/PlWm8WHU6QVySGPoD81umA2SXCY5t2tzskOshCPwiE:/kpcml0fioQfGQ5sCht

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2