Extracted

• • Target

    GorillaTagUtilitiesTESTING.bat

  • Size

    3.3MB

  • MD5

    ead68831e2ed9e4ce953eb7a51116cbf

  • SHA1

    2cd81072ea5c1a0a2b5579dd7fdfe821964bc30d

  • SHA256

    e9f762f745167e63e21a8247b246699fe126df916b2b810c3ced6e850dc38405

  • SHA512

    8b99e2d00a7c0b167754ce60833fd869f59441f23f13c38f6fc9f3c3e9573918d85d8bc0f3276af5747c26b13a659a884fd6b79ab8add0b93ac975c96537ba5e

  • SSDEEP

    49152:OCRVrQK3EzM+Onde8I+zS8Ksjk3YSIqHzM1rkLAwksEzkxB16omRQgKfLyl:Oi

  Score

  10^/10

  xwormpersistencerattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1