Extracted

• • Target

    SvEdge.exe

  • Size

    169KB

  • MD5

    c43a0a4102006a0124ca976e72db6945

  • SHA1

    c5afa305c0b8d4c66eea89e4e9232eae27d62815

  • SHA256

    3cb7c98c46f7b66f88e1e07248770614138daf285268b6ad875c401733c48767

  • SHA512

    c048c850e4e9fa04ec84ec8780192012791b45e2d6427e449aaa6a8069198f8778b6bdb78faab910f76fbcc4036bafc850f684e5bcbbace89c4d307f76c9874d

  • SSDEEP

    3072:IYAUcbyb6wlaODbl8RUGKXs+S++7KFSbxeY+qDDrMl:IYAUcbybjGqStKEbxI

  Score

  10^/10

  xwormpersistencerattrojandiscovery

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2