Extracted

• • Target

    IpGeolocation.bat

  • Size

    610KB

  • MD5

    624933026776b6141b7ca87c9eccb8d8

  • SHA1

    d7d6388d6266360e14d7c6b56141a92053514387

  • SHA256

    1bb8c8c19237b327822cc6fbc537b9c4d50c549ff15f4e71abf84a2341eec0db

  • SHA512

    2d4617a578a45ee95e958fca89fbcd37882d9ca0d4b9a41e354d2901e3e19b75e9a96b7da5c9e5fdef3c9358bae06529bc3f9e2a74ae83fc3c62ae71a52f8958

  • SSDEEP

    12288:M6nt5tlBhJSv4euiIl0Mhw0NbmInJpiudZtifyI72IaeYeeI:MQLlwdIyMhPnJpiWy5YdI

  Score

  10^/10

  executionxwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops startup file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2