Extracted

• • Target

    Vclient3.12-loader.bat

  • Size

    337KB

  • MD5

    b0b26501fa33bc553f9a54ca28a89a85

  • SHA1

    9f868d7d464375d1ea60c5234f4dd057ea85fce1

  • SHA256

    f60cc29ba04d75d31227e8f0417640ed962d2cbfb537072b1b00aa89df9be473

  • SHA512

    fcd9680de0ce271730f9cc5968d3172ed03e2463e53af66b19c898e7ac0e6c97717f8948d27e329f30f78ba051bb4a81acb4dc837ce602964e64470a6a0f3069

  • SSDEEP

    6144:7rVhpfca9iHDDTI3nozeFFDNwPlxR+RG7PrwzZ0qw/FU1qBIEhY:dbaHDunIxoRWrOZ05U11EhY

  Score

  10^/10

  executionxwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2