Extracted

• • Target
    e9905233078468b1b5b58198695c63bda4d6a3580a67bb5cba33d545896c9da8.bin
  • Size 1.7MB
  • SHA256 e9905233078468b1b5b58198695c63bda4d6a3580a67bb5cba33d545896c9da8
  • MD5 adaa2d9dd695cc319d0e31cdd688e3bd
  • SHA1 f30673bee1be95e85c4e9deafd42fb49919b81b9
  • SHA512 4e2f8ce74bdbbc04cb59cc0cd87e42391cdd6b28422ace50d6492996c49ebfdb382ade37eca67247e6f42c374a8927a049de8811ab36997c020dfb1adf9ad00c
  • SSDEEP 24576:YQ5nUME8swgMOrLT6zlidFx0r6NS+hnPTImL1yXojJD:YyaxT6zEdFGohnP0mLA
  • TLSH
    T14A85C022F399569DC62E60346A929F07F331B8541711ABCB27F91A950FD76E00EFE2C4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2