Extracted

• • Target

    2FEZ4_WindowsApp1.exe

  • Size

    417KB

  • MD5

    e039c59410e9cbba059a36f31b4b7c53

  • SHA1

    b0371be344811b418d30c8baabe7cd8dc9e23fcd

  • SHA256

    4c7fece52c1341f3af5ff77e865bea333a720479238e06f48f28b1db5107d76d

  • SHA512

    2d82ae0239e20e9278b116750ee2d09f80a3eb878aaf5d0dd03d574707cbf4789b63e141d52d19554f15dc84a94f652caa0753c803d19e0b7cb6317c40a75057

  • SSDEEP

    12288:+JS+6RCreqc4vvqjN4L2MXCB0TFAWjLzF:+jsCrehIvX2M5T2W

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2