Extracted

• • Target

    XClient445.bat

  • Size

    100KB

  • MD5

    fae4477da536f3adbabea61ddd20792f

  • SHA1

    f81caca3fae8a78e94333981f51cdf542c36eba9

  • SHA256

    be385f657b8f5460860b3ed2040c194ed52b8605bb32120df2cc675fd8ef5cf4

  • SHA512

    309da6ca1509e593c25d0eede1ff0c331cb1586cd8d21873a1c54ba7c9f55ca59b0af6590d092a086ee7e96a699e79ff57f9494d54fdf5c1c7b9c256a575e411

  • SSDEEP

    1536:XxQgYbiOtDPxTTeMhggpzmryO6hdwNaF6zeiBoM0HhtYaAfBbLvs5Om3l3J4dlVQ:BPYuOxRBxcryOfaF+dO3h1AxxmV3QTn0

  Score

  10^/10

  xwormdiscoveryexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1