Extracted

• • Target

    Desktop.exe

  • Size

    1.2MB

  • MD5

    2dce02858aa01053276e5f91333f06a0

  • SHA1

    2de850a50f176a79dfa1ecb07ac8c8af880e349b

  • SHA256

    efa06e9799ef360dcbbf7d37e046986ac989adb4409aee7ad175767a035fa804

  • SHA512

    23e63cb23771d5783f2d1883a8c68edfbceea94b7da11d74db3402e22a9cde077cd6033d959082aa0cae28db9ce8543a7c3d322f04cfac34f816c8219c1771c4

  • SSDEEP

    24576:yuDXTIGaPhEYzUzA0bgQfFWC9zLVNkxfwJoMwnvoVJYneEuzXxh8p1WCmK72IfZ:1Djlabwz9kQfF5JgYqMwnsYn7UkkDLIh

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2