Extracted

• • Target

    InspectedSetupFreeV1.3.exe

  • Size

    100KB

  • MD5

    32fc084c514fdd90340e84c95dd1b1d0

  • SHA1

    c216536523a116d7797211f82f46b7c736871962

  • SHA256

    d7d0c2631a0b521fb3e0bd438bc6039672c9892d305e0219bf48daa6fa304336

  • SHA512

    a254b4048e11c95fd4676eb976901805c2ca82adb7caaac5ec0d83e089394a2abb04d109c3c95aee9a4500dded124c3e999cf31e57758f5c59b070a432c1eae3

  • SSDEEP

    3072:z0GvrRmy5wl9za2BL905Ft1zcYQ9jmoUZ:IGvr5wlFp9059zcYQY

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2