Extracted

• • Target

    SpyderCrypter.exe

  • Size

    5.4MB

  • MD5

    e1325a63b8b72e857bf3564c88bd0b94

  • SHA1

    53ae94b8d1ba230e6a7d1144ac44e439b460a246

  • SHA256

    cf2aed676b0ee65ef0e5bad5128b72f4c2239bf9e5e042056bfe7cefbba3089f

  • SHA512

    50c1c24fb9b44227e141fd89d9941d1e34440cc4e74497b77976c728dd09aa8104ea0b87d81b30a8fa55b3f140af4767284d6eeb4d4498c6706c91a0f594aa33

  • SSDEEP

    98304:UGh/Q86Jps8osXwn7K9V3VdB+1dZZejxS5e8sFLi1Fwo4S6qE:dhIokeYUejv8K6E

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2