Extracted

• • Target

    Chrome.exe

  • Size

    197KB

  • MD5

    f956d04fc1f44a110400e8aaf76fa48b

  • SHA1

    8c8e7b049e81058dda63facc0aeb790f670be99e

  • SHA256

    e413b898bcf92f62736144346100f00a74904a13d94cfe4d2aef5aca31e1154e

  • SHA512

    95e5ca134e3479bde58a08567935ef8159b20dde7157bfeb81c23929ae7a89a15e699e1764c7dcea4d23cd254d27759f70af5c6b7e21c9d3358f9b4019539224

  • SSDEEP

    3072:T4z/dMSbSzout45JpO5JMal9SXe4NpVq8BxFRzaqF+o2GQJ7/JzqVfGv9:T4Znb0out4n+/gVqwlL

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2