Extracted

• • Target
    Process hacker.exe
  • Size 39KB
  • SHA256 f326b722d4dd6d61359b374019a3cc74f2fbd4b3b1511c2d647b08fdc7f33135
  • MD5 380f1aa5a0b081df600dd3963cea32b2
  • SHA1 10cc40c32bf6fef6f58f5980b9a4413115c0e608
  • SHA512 1dff1708633b0187edf11e951a733ac3c8928ca2e9a109483ef5fca3118a86d68e91aefde51657df6ef2c8b862dbf5f05923e8742056deee6ff684284ef9047d
  • SSDEEP 768:7V9G+zrPxNlxd80VuTU35uXuyjWxF5Pm9j/Tl67OMhZ3IC:7VvrPfqwP8u8aFM9zTl67OMvx
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2behavioral3behavioral4