Extracted

• • Target
    MenuV2.rar
  • Size 741KB
  • SHA256 ca2d4b59516509c4ae1861a252be838cb58e6aeee8f3294df405204e964a5c4e
  • MD5 26f0acf3a2b34536d6685207add19ecf
  • SHA1 7644dadc627d99c0a913e1a45ba427e25f7a8a41
  • SHA512 3cf71d752075c9e8f25595ecc27fb5404ff1d7a4b097c186cba8dec60c293779157a8b618f583e974e39823d437c2cdac3058bd9842ffec2a82658a46e66d9e0
  • SSDEEP 12288:ptyBriqoTKsX2ayvr5fEFyUT93NiMeN1PVNFC06LtjsCJ9JHfJae0bxKchypYNTS:j0riqJker58FygYMe5NFQlHJ/we0bgce
  • TLSH
    T136F43342E1668CB068D69C6DDC71EED1E2F208C1513FF0591C6D0CAEBA3E6D625BB6C1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormrattrojanransomware

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2