Extracted

• • Target

    VClient3.11.bat

  • Size

    422KB

  • MD5

    869440ffbff098f2805f2bc6ddd1a9f5

  • SHA1

    85bac325a849358f534772363d8d3b5b7f7e91c7

  • SHA256

    18baa5efa951d971177b202c4e92aea450f1fd7ed13b5c629e3d68340fd0a4e9

  • SHA512

    5754c683da58fc952f804eff82cf4aedc4fdd2ea9e38a1c534ae4b894f58926ffdd13645ed781ad4fdc7318e705a03ec67edc47dc90a0619056618d18df3815a

  • SSDEEP

    12288:WaixzMk1buOdyDvE79qIGvL9PmaOkweC18n1x:Waixf1buOQvExqZdlOkwe+wx

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2