Extracted

• • Target

    patch for version-d8aa63d3654646d0b.exe

  • Size

    82KB

  • MD5

    3e38bec199f483f558b0330030c4165b

  • SHA1

    5de15adf326e0827ac1162ba5c13648691bd46ca

  • SHA256

    7493e1a3a07f3e5ab65faa623d7c228360e4f3fc3492a5cbf69f1bd1e61da100

  • SHA512

    ebaa9fe2a723d5c77ed4caf6bae973dabdd3da7725b3439fe18d2410a7df7d206d49b3dd506d8ce5e9db0f2bda16a96ff16edd4e2d92fd17b9ec7d993889a802

  • SSDEEP

    1536:dB7gCNuU8ZsEuE0toc3zTB8Xo2FtsCQ7OGCnbSCUUSbK9mXSB6VPZ+bOWgu6Wxh+:dBpP8DqtvDTMqCO6nbSL7+97zbOWguhG

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2