Extracted

• • Target

    VuxaSpoofer.exe

  • Size

    3.6MB

  • MD5

    d4473f64014380bd2f087935d01e4cf4

  • SHA1

    39d009e253008ed76a65c76bcd55010b016638c1

  • SHA256

    7ad235452a11f0343fcf1def524d04800e591b13e40188cc1cf5be37e9628f36

  • SHA512

    27865bf8b587ee2b5da590ff72a510702591e52c2d8e377cf90b44e2a602ae5a6f605231506cbd65b41fa7c28df332e08aeca3fbb6ee0aea9c33540179e3ed34

  • SSDEEP

    98304:GLYNYcvh7hfw9An9todOS5J+ZkvtnpKLiFqI8wM/4v:GLw1hFfwMrQOS5fVnpKGFm/K

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2