Extracted

• • Target

    fd9d1dfc1cf359603277712f179a5616503dd8ef4616149782873cf87fbff728N.exe

  • Size

    52KB

  • MD5

    57ce7a327782d47f5a95f5f73548d200

  • SHA1

    1df4b4a4ed70605a7fede98f8c7e1b80042ef73e

  • SHA256

    fd9d1dfc1cf359603277712f179a5616503dd8ef4616149782873cf87fbff728

  • SHA512

    1aaa25fc2a18ce8087c3c37bd9097d3e78910324f9992085690fed471f3a00bcd74b249f332bc7824361499e8dc27aa676421f4d82d0be04246703f3e2cae41e

  • SSDEEP

    1536:cpHDSBc87/UWF70l/Crbi/OZu71Omwkn2OBCy:cYW8rHF70l/Ybi/HOt+fT

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2