Extracted

• • Target

    Vanta Bundle.rar

  • Size

    100KB

  • MD5

    b622d4beb1f53e776cbe210b5c0bd3af

  • SHA1

    c7a09721ad876715a9c419db5da263fe3dc1d905

  • SHA256

    ae790bbbadeb38db0e345970612a859e0b9888c976d798105a48a81ced48ff40

  • SHA512

    460ee20a7e044e7351bcb6534823ea28f30de20e71192571ef351b72e559719efd2ffc70f176fe39cc8c03c4c9e52f5ee26aa3897f76cca403a0eb0b6d45cd86

  • SSDEEP

    1536:e19R7X+Z3yNPvbCrWNHdUUYtboOeJSpL0VblnPwVa/YgL1m2msA+N40rEVc:eByZcDCWY1NoOlpgVdwMnL1ZmN+N4wEe

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1