Extracted

• • Target

    Versal Client Beta.exe

  • Size

    68KB

  • MD5

    3e7d64259b363be8f8d3ad5ce94943f4

  • SHA1

    7e2fa2fb30069c3a7ce3f523440497d30ff6164f

  • SHA256

    992fa7f194c76a9e6155a13ef849ae3fe55c3bd7954d3a08cff1719fdd16ae1b

  • SHA512

    cadd51b55ad4ee21ed3c21bc462d034122fb5068c5bd8b82e61f2019c72d70c01f7c3892c916da6b89c39ba73ff9e65e6f52115fac3abc929796194008f0fca4

  • SSDEEP

    1536:SDhdopFOmcMwSlUHbHzMiwO7EsxNbqFDAkIhQ+pnOhZ46+2dTR1:7OMjYbYiwv6NbqDXQnOPx+Y1

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2