Extracted

• • Target

    6b59309ab12f1859a94fb2ce1c98639b2a538e6e098ffac127e45c29733bd993

  • Size

    94KB

  • MD5

    db5717fd494495eea3c8f7d4ab29d6b0

  • SHA1

    39ba82340121d9b08e9cf3d4ba6dfcb12eb6c559

  • SHA256

    6b59309ab12f1859a94fb2ce1c98639b2a538e6e098ffac127e45c29733bd993

  • SHA512

    b16c7bffc8418a0349e5189d61439df325d2ab33a42c720380a305decde00348f83d96b6c263a95dc253128eb0e47b1a3dc96f8f115da868ff9227b9a40882de

  • SSDEEP

    1536:1z8H8uTSHKoKlDeE0C3shB1ueVby8EXEFA4Xib6TWcgMfAOISZsw61EmS:+c/q/l6EP3mvuwby8EXuhX6cgXOI0stE

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2