Extracted

Extracted

• • Target

    XwormRAT-6ffec2e3e08096b1a19ed5cbb931590c3b0c2c5fef87c2f221bdf00099736fe1.exe

  • Size

    325KB

  • MD5

    7a52c4004cff0607cfb41514a8012304

  • SHA1

    c2efe4e8378102db567520c9e6b8f8732ce078b7

  • SHA256

    6ffec2e3e08096b1a19ed5cbb931590c3b0c2c5fef87c2f221bdf00099736fe1

  • SHA512

    d61e7a2272a9898b19b53bc5f94f72a8bcaf079d974eadc92d1b14d7ff00323245c7db33274e630ef9d8441be4ae18f378de5ddfe0bf0d9486eaf4d19c78feef

  • SSDEEP

    6144:y9Nue9jnROyTeAlUueYEL7AK52Z5+GaavsQXrJw8oB2XiOG:yfOyTeEUuLEL7D52ZQGB0QXrdA2X

  Score

  10^/10

  umbralxwormratstealertrojandiscovery

  • Detect Umbral payload

  • Detect Xworm Payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2