Extracted

• • Target

    d247cef9a16acfbe133b01295412093b56ef0d26d8a10f6e9b72cb31d6e8db10

  • Size

    292KB

  • MD5

    a25ea5ab2a959e8fbefe0724f1bb5b5b

  • SHA1

    49208ffd7c4a5a6df5336f1269f2fa7aeef5fe18

  • SHA256

    d247cef9a16acfbe133b01295412093b56ef0d26d8a10f6e9b72cb31d6e8db10

  • SHA512

    4870b56c286516bf97e4ca8cd232a5978f423c2d3a971218866ad8ce50e68fd382b7d97f5fe8fb443a99d5d99971f75a09524526536e292d258831abd12d88b4

  • SSDEEP

    3072:MpkJuuEpKi6m/PJivSaAFOg7lkjcWVig058YbEASbod9btH:

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2