Extracted

• • Target

    84d354f7018370bba012bf66ed07844fb96f8f59884f1d102ef46794d650b450N.exe

  • Size

    9KB

  • MD5

    0df8781dad511830d4722e2f140f6c60

  • SHA1

    e69045c7a0270aff84dafcd813c05ffbb4c7a20c

  • SHA256

    84d354f7018370bba012bf66ed07844fb96f8f59884f1d102ef46794d650b450

  • SHA512

    653e7550359149b2e383b360a83f0e2bda7e1f14e2e23c8c7296e1c5f865bb83599d550b916c8d2dd6afbef072a17f119f03bc33c51cdf7ce9abb70caf24f3eb

  • SSDEEP

    192:kmGhMITEquCA/a1zbhQ5rycbXfrxQNsWkhbv8EFm/Q:km7rquN/a1zbIryePraXkhIl/

  Score

  10^/10

  discoveryxwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2