Extracted

• • Target

    XWorm.rar

  • Size

    59.1MB

  • MD5

    6ec728dd292a8e1f39cd6baea415ff66

  • SHA1

    e1103f0af9d27f5c56667d98a36dd40ab5ec8392

  • SHA256

    c03c2ec5ef0958a61a913e2bfb80a420a030f579858cc203b3d2bc3b938400cd

  • SHA512

    ffc584bfb586e7c123f5e7c153fd9e9187e7010e7b4bce9ae590c05961bbbfa46b4c2f25ded830626e30aea919cec31f7026ccf699510f8cccb1921507829a40

  • SSDEEP

    1572864:c3UGEBh79oS6ea3nG8zWxYKClanZV79oS6eaqAHRvr:QEBhxb6eaxixDnZVxb6eaFJ

  Score

  10^/10

  xwormagilenetdiscoverypersistencephishingrattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • A potential corporate email address has been identified in the URL: [email protected]

    phishing

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1