Extracted

• • Target

    NEVERLOSE CRACK FREE.exe

  • Size

    66KB

  • MD5

    1cf87ed16775e956ca556f3948b535a7

  • SHA1

    20fe1d6699242591b2c86dd3200718822fd4ccdf

  • SHA256

    9f7c00c1656ae9f0d8f044e1de0a9783f29772a7a0897383bc00158ef3a77b32

  • SHA512

    a4daf6899c0fbead8cf32a9120860c3059f1c78164482db55c24293f361b2286be71c494a35409279ca7555e9c41ea394a3d426258562b5ed3c3ee9254689fb9

  • SSDEEP

    1536:D8JtOqoPKs1e3YNhXwfQLbbtoIi45BMJ6COEhKKGx:D8JtOrCs4IN8IbxR5uOEwx

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2behavioral3behavioral4behavioral5