Extracted

• • Target

    Xworm 5.2.zip

  • Size

    33.0MB

  • MD5

    59043b724d293c256219ebf504d7585d

  • SHA1

    f0e7f97669840a24cc4540b1b6979ab38e87c896

  • SHA256

    4573900c7704aebc47134753fc2e52d4b26a4f071f6cb76d7ddcd00e2b3f6331

  • SHA512

    ee9ad2e8407aa4d5d63d3c10c862ae9aae8b5f652b0663d77f0229fd01238c1e13c807c87aa98321e5a1c180cd45da94fb1286bff34227bcd3b0aefa9cffa109

  • SSDEEP

    786432:5wtNX23QgeyHmwthL9zcsV/gU9eKVGa8WzFvXCif1+u1OO8k76HU3QmMzS/BA:SX23QghFH9ISgU9n/82FSFlg6UAmMOG

  Score

  10^/10

  xwormagilenetdiscoverypersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2