Extracted

• • Target

    XWorm V5.6.7.zip

  • Size

    24.9MB

  • MD5

    2213698ec3e3c474acc535dc58071035

  • SHA1

    fcb9aaa7b05e7078e0e244fb0a71ff5cefeb4ce5

  • SHA256

    e63f04c2735e3d0ee6742d58593e7864e659d09ba93918c8beaa95cb009743f6

  • SHA512

    f03eb21e4f993568ea1d633b86b4584f618cab4874f149e3b5bc2fec71a333045b3cd79e217290100ca34bec0233c226e40ec45593e29ecfa4f817fca8853022

  • SSDEEP

    786432:6ChH2a2UxfDfgSnVpgXhrCT0kw0Q/XbAtILAfoJbx4:ya2UxfDfgSYXhrCTvbQDAt4AfoJbx4

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2