Extracted

• • Target

    1_protected.exe

  • Size

    1.1MB

  • MD5

    0bb46f1aa0f9ec8b6ce4a718a6ffe8a4

  • SHA1

    621449aa1d94f91b30ff7984a7457d6aed2d0075

  • SHA256

    82702da0dadc378e1995679ed5cab6ae3d3c3e189ca7f3401c9b047e53b4648f

  • SHA512

    5cd89e242d980aedc9fb0f0eb28b0202a6a6c5db6c1146d8d7ecebc72235982d9585086e4c9f62c9b0af8d7082c72b7397de468280050da0b438bd6ebbd5d443

  • SSDEEP

    24576:z+S+kx/5Csa5XNTFb4co+R72Rg1wA2Ms3zvFrA8kAbdmxm7y/:5+kxBW5X5Oco+R0c9+DSpAbdmA7y

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2