Extracted

• • Target

    aznuril.exe

  • Size

    35.0MB

  • MD5

    71a8a8297116bb9e6a527c82db38ae0c

  • SHA1

    f42ad3f6636c5d987939033d9cb09b657fc2a76b

  • SHA256

    b6a02bede9af95adb28ce056584dfed53a2d70a8bd7b76c919392359139d39f6

  • SHA512

    f84b9b160f6cbb5b1ad7947c0ebac7cc7b24d379b3136f7ffa6becfe3bfedcda2a7008779b25334b1572a9e6f6854ec727f57b493d913cbf59a33a90e4200db9

  • SSDEEP

    786432:vkudQtsmW+e5RU2j6+s7LWB75zuk2q9TqyMeLBSQryklN:vjdQt9W+eHU2qHWB75ikfNNBShWN

  Score

  10^/10

  xwormdiscoveryevasionexecutionpersistencepyinstallerrattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2