Extracted

• • Target

    1dc7a4ad54288efc5a14d346f1d27718b701733a948b059ae462bf07ec07d474

  • Size

    239KB

  • MD5

    6fb0192d31bde4e8b0d5d912322ea8d9

  • SHA1

    153bdbb4235e460676bb765372020ae754e73be0

  • SHA256

    1dc7a4ad54288efc5a14d346f1d27718b701733a948b059ae462bf07ec07d474

  • SHA512

    992062d566bd2ccc6a58e92c337761a19686a94d9e89b8e9d8af62aa97da6ab8705886753315184a44de6f6da3eeca87af1fe4ba5405786f6c3472bceaef4136

  • SSDEEP

    3072:nDOTa8CC9ooblQ7zDoxB4OlBW3q8SKfbzxcwg7es6/Vsb8VKTu549oJMfF/H9N3Y:DfIbSc83qUhcX7elbKTua9bfF/H9d9n

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2