Extracted

• • Target

    MonkerV1GuiTest.bat

  • Size

    294KB

  • MD5

    2b235c5e792b8c3dcbc4ccd0ccff02de

  • SHA1

    6dd8fac6545df5f64bda4e746f3921d9a072bb59

  • SHA256

    ebd66fd9265f312babcebc214c9e23433e0c0e88504c5859f034bdacffd54ddb

  • SHA512

    cf61c50763cf8656bfb23250553052c1191179d30b50884f1cf8dcae64be48eae8dc43b9ccdb453e38e71bd4f5cfe94f8d44e86ba80552232eacdf23bac99e2f

  • SSDEEP

    6144:6pA2upleIJqLKXd33GCpiMcOa+7seZEN3CbryZPhvAF8:6pAdpwoqa93GO2Oa+tON3CbGvf

  Score

  10^/10

  executionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2