Extracted

Extracted

• • Target

    Services.exe

  • Size

    163KB

  • MD5

    c9ecd9d8da218f635e1e3eb17b36c5ee

  • SHA1

    6b14cf165fed4c9162a4eafa318b4fb0c36179ae

  • SHA256

    4c411c00b0aba3f592a7528c2b2fd66198b0a70ae32a253a7d6d490d68e7f6ac

  • SHA512

    3d08906cb93b6fde2ba00b857caba32d5dd6d787fbc9356a310b8bc8688620a0c7f2a39114dbd705f736d5721f6ca613d859ccc3b752f780398146801777be5e

  • SSDEEP

    3072:Ie36qVTppS1GzxfExMNtuHBZYyHm836yDlWH7wUoh4V5RuEm9:I+NVTpUkzpEYtuA8qClWUGD

  Score

  10^/10

  discordratxwormexecutionpersistenceratrootkitstealertrojan

  • Detect Xworm Payload

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2