Extracted

• • Target
    Bypassed.exe
  • Size 193KB
  • SHA256 311a611abd9cd29b3471df78dd323a66c995c20b1e12cf1cb5bc03ff20eae2d3
  • MD5 305a8bd58b2cea26143a44c862c9f90f
  • SHA1 f5da18ffa14c2701ece9d0cb97cdd5e91d8a87a7
  • SHA512 acf8c16a608ba1467c18fdc7d21bf475fa1a209899406a8814ef5170095d8c7e885d5de130e739fa05d254fb06bb3938e9656611914fda84e2de7d4a6f43eea7
  • SSDEEP 1536:/oPTD7WSTUGO+ZWLc+kWdEJ3RSm3RmFi74Hy5++EBBqRUH8hs/hGq/J1Ov/Ne0e1:mFmLeW4QHFBBqeHd0XNe0ePTxr6WJ
  • TLSH
    T17D14E42529FB508DB373EFB12FD8B9FF889AE563191D60B6214247074B22E80DD52739
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2behavioral3