Extracted

• • Target

    Loader/Loader.exe

  • Size

    65KB

  • MD5

    953c5ee665a24382859895c809863f71

  • SHA1

    bd5d449219e4ac4e85fd7bb73d7d01b25510ccb1

  • SHA256

    4b0cb85d10fc187ab5e035b7d645b16e454c82a352cf5f2203ababb0b891b02c

  • SHA512

    244509e35905d70df2f660df27b1314afa2dbc3e43eedc27ed96fdffc405ca92ada9a1f9c39dabd0a74eadb0d54b8de65386459e92b5a28d57b3cdb93246be36

  • SSDEEP

    1536:iYkFPI9d/06aXbJp5vUMyuw62POmi7ULfGn:2q0VbJpFVYOV7UjGn

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1