Extracted

• • Target

    disconnectgay.exe

  • Size

    204KB

  • MD5

    68dd1a76fc4bdb732204ad44bf1e0639

  • SHA1

    3e1de19a1ae82e5c23d978b8d983862de22daed1

  • SHA256

    76ba16167fcd6bede94c1ad5599abc58a4f0a0d604f3e728a1532c99eca62bc9

  • SHA512

    d5b1f21dfed9754cc458c53a119cf48d69b11571e0f61c4f7935405c59576854eef33629ef19edf5f19b100ad8faaaf1025b3805e9647495d3371a19ee362baf

  • SSDEEP

    768:0rhEUufggpYyT87I2cYKjGOMs8c3uHFEPa97iOChtzjmXHf:WqYBcYylMq3kFJ97iOCHSXHf

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1