Extracted

• • Target

    build.exe

  • Size

    51KB

  • MD5

    79cd45fb4ce03b7262bfca18f71f76df

  • SHA1

    1cb7866b67768b8f15415cd33a4cbc1d284cb77e

  • SHA256

    495c535f89ad9319b97b59b52eb5d690315c202f9add743061dc53b4b583b610

  • SHA512

    370ff53c5f3648667c761c9d60f4f3ace99e2745b0253780c8dd0d87bca3c03e65c60f756bf8ea17a2f0790dbefa6ede6c0bcb7014f921cd51c945d53e4c8950

  • SSDEEP

    1536:fwFIJ7n5Yptm6YCLgJwu4NFD0T5YKAYjZHgbyJ:pJ9Yptm6YCLgau4NGTJAYjZHWg

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1