Extracted

Extracted

• • Target

    Sharp CS V1.bat

  • Size

    555B

  • MD5

    0d521243334977834c249e26f879d0e5

  • SHA1

    c8a6339e8aff5ac5db00dae42a5f8c577b814421

  • SHA256

    cb8da43f966cd7d743931093a1bf1368ab46628357b957407844c05d7af14e5c

  • SHA512

    32182d1b82b55eeb771e816f3fc60a02adf8c6224407f52f2e92eb6649143e0b8d4901f1167b32f096425937d855111948dc40a7969ed8d4433485cf7628172d

  Score

  10^/10

  discordratxwormdefense_evasionexecutionpersistenceratrootkitstealertrojan

  • Detect Xworm Payload

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1