Extracted

• • Target

    loaderv3.bat

  • Size

    300KB

  • MD5

    82ce24de6320cb72c527deda4c1637f9

  • SHA1

    aaebcf1e94c9ac15b129e2ad8aa89288fb4fa6f8

  • SHA256

    5ec787845e4c8569e81a28a415e6f0ff5b3ed9012f0cb30d1558adad98cd8680

  • SHA512

    c24fc762ec4b8dda569a502e93a3438460d8ecfacf83a5a2b9b0545338bd6369d861b56b9b96db0cb2e0914e751099be152fbc6d2cf018f15d7756a7e63ab048

  • SSDEEP

    6144:w4WQ1SbqrV+rICzcuHYMq6jBo/CDlcQOxS:w4WQ1SWx+r7vKgICDlcQ8S

  Score

  10^/10

  executionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2