Extracted

• • Target

    47e602735f8059e787b432de5f00575c.bin

  • Size

    1.8MB

  • MD5

    47e602735f8059e787b432de5f00575c

  • SHA1

    fd8dc8ba2b438de30599835d2cfc5b7fbb682c39

  • SHA256

    c5dc5b0b78ffba40847d9ac8c6beca81d20e9678204ac4a8b35c09b0610d47e9

  • SHA512

    06ec7541919fa2623a6a8883a15f8b24c5027a55d482a1aebc5b727a07d92b50feb36a3e80d80656cb6b38e9a69cc334fa5f5db6ff4d8c26b8fec6de82949610

  • SSDEEP

    49152:QH7JbhzwEjVVaQ3Sn7GMYav7syYcONey40vIx3+I1:QH7JVznpVaHtvbOHtwx1

  Score

  10^/10

  xwormdiscoveryexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2