Extracted

• • Target
    Nexus Release V1.3.exe
  • Size 33.1MB
  • SHA256 9422644a39273f689b2bcfa94551a4bc4815ed9c2efc4871367449051fc7f3a5
  • MD5 8773d9453781de0fbeacf41981bd8d96
  • SHA1 1a5a743be30f2a875aaf95d0bef33cc2ac12fbae
  • SHA512 639dbf4485e774ef89cbca90c06a6d62d3498fd08bbf5eb70def69a18dd62feccb6c4f496da7bc39b06cab5ae0ec2e7949f3acabc318d84875eab409fc3ccdb0
  • SSDEEP 786432:8Li7Hz43sAsAmyb6vA/m8MCiodyuDhJGtucV8wdJ4aqxZq1gjBo:8+7ssAFnbkuRpbyuDrGhVVJ4bq1gW
  • TLSH
    T1BF7733E98A6CB6A39E43B53810D37612D53DB74DB7A7B2588E1122200A4F057ACF3D5F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1behavioral2