Extracted

• • Target

    3668c5ce7620f92e5f39cea22c67bb89132718ad3799582ea326df60882572f3.exe

  • Size

    2.4MB

  • MD5

    7ab47cbee028ace83cac84f0f5cde714

  • SHA1

    b84f3f5aa68209f2a73acc2377727b8e481f3287

  • SHA256

    3668c5ce7620f92e5f39cea22c67bb89132718ad3799582ea326df60882572f3

  • SHA512

    a4d09b2401b779bf352413f341ae9a982b3914192cc7f377a5943be827b43797e4825919fe6d7230364c26db25ccf96f205daddb5cbab12ba623f56afbd42ee9

  • SSDEEP

    49152:+2uqU+xRoatgQBJKweR4RF8gAGBJ7dj9Shv68pd3hm/F4OGP6J:+2uOxRoaOQBEws4gWrhcoq3HOzJ

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2