Extracted

• • Target
    infected.exe
  • Size 76KB
  • SHA256 a0f69b466322e4b95af9d008e4ee9e758dedb3b27a5c6a50d4361ccdd88c3ae1
  • MD5 a1afaea404e9f505c06b6ceaf087bad6
  • SHA1 f3231b75673922e3dfce1706a3a5587979f04c25
  • SHA512 5fa770e23280b31f84dac094243e26b5176697eb4235f67112afde6d82e064278cf42ccea9ab1d236740a87648681ef4c673e06a7e2dee0b8d5c2d0507035dc9
  • SSDEEP 1536:xA98LuxE8SsXHwshIi6/C9pAkbGq8neagvtS8d6Q36TjDOmUH3o:xUsux/1HhI1/C1bGR3gvtopjDOmUXo
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1