Extracted

• • Target
    LabyMоd4 (1).exe
  • Size 560KB
  • SHA256 910351824ec9121d841b498baca5f57acc383f20e6ab755e5d353a9d281c4fb2
  • MD5 2ae96ec953ccf1e0334f53b423a0f9c5
  • SHA1 ad213f9355f9eba4b1c93f9134d0cae98508c350
  • SHA512 9dd0157e71086db20d54741ddd304ffc688d85ff01558c3660050a5471ec7c5933590e7fc79cf40147dc866fb3d3c3c7cacec6140ca2d1ff15313686850fb686
  • SSDEEP 12288:B2rL+p6X35aAXuxGM7bGNMOddnSIXTHUhI:c735aZMzVjUS
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xwormdiscoveryexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2