Extracted

• • Target

    .exe

  • Size

    36KB

  • MD5

    773e091978fdcdb5f20a117c705c759e

  • SHA1

    1f5889ac02c7e7060f7ac8772f317f2ffebdbc3c

  • SHA256

    1baac16d05578f8e64687053dde830d9441cd7941cebbdda88338f1fab11fa1c

  • SHA512

    017a41f88c976e51b5d73679c0c4801b30ac4a066f1b35d3846c2d1b989f464c501b74ede54ea0cf344c45d315647764b4bd939a0558bf0b73fdf630c546766d

  • SSDEEP

    384:axTA5yOqIMtqfZD1vkSQLVxXafuYAJ7uxhXv9LzGJTiKTFFA5mpkFy7BLTQYZwn5:uTAJM/jPWzJzGdFFALFyn9CCOjh+Dqf

  Score

  10^/10

  xwormevasionpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Modifies Windows Firewall

    evasion

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2