Extracted

• • Target

    binded.bat

  • Size

    1.1MB

  • MD5

    4fcc4a79a40b5d4eda4116d6296dc607

  • SHA1

    4f140172d00f5a40eb9c0f07b166cfc2111f0d71

  • SHA256

    888b6ce9498a1425df0701fdc73c99c255684ec192db6290e16bb4c82da8656e

  • SHA512

    2614afb3e2f7f5501246d79c7871710d0048ebacc69e517766709fdcb56e858c27deb4ed0fe1eab46f8175033446fb2f720fb43ff161552986d31dd4a8e0ccc1

  • SSDEEP

    24576:vVq7sFq6XgPKd2wM6RcN9vz4vO21SCKesDu8a1KZ/4hvXQ:vxlR6QBsxb/4C

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2