Extracted

• • Target

    CrackLauncher.exe

  • Size

    191KB

  • MD5

    98b1561ecabd53af29e15fd24fb6133c

  • SHA1

    0abc0d9f876fd1f4d462ca0e98a26f50888bfe10

  • SHA256

    89971336e07df62f424de5e5770791eadd2ffc52aaf46a96723c03f62881a459

  • SHA512

    17610e949459e988667552198a8a61b340393f83291830e6ba80f0922f0d0b43bafd0bc8adf2d7d177ada6f82f91f3f21327d3c414e54dae04530f7467cc4ad2

  • SSDEEP

    3072:fRbPR6L5pB7TQfxa+FAK7iZlnfjY2iQbj2EWXo9Yr/9YM8Hqgg6b5:5bPoL5ppQNdafsEj2EW4JMV6b

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1