Extracted

• • Target

    QuestClient.bat

  • Size

    456KB

  • MD5

    c2cd34623e825a5da3bd0c3c6a7cc7a0

  • SHA1

    1ce81a2392bff443e04b97a9ff76e0316c1ca850

  • SHA256

    70c57f82283c07c45bca13b478c4f03bb81387e1d4b3945fc3e6c2483e878bc8

  • SHA512

    ba0895bee303d9ff1e268b7cc512bc903a12465b6737f21594107d040592f8210b83c26bae3c0f6d0b9a12fd98f8702305a4b3b409a6b63b15c9b2a8d0b34ecf

  • SSDEEP

    12288:Ve9+GI3rpF00cj8PF4617iCV1sYJKyoS4osZcD48:Ve9vI3FqgmCRoLosWDD

  Score

  10^/10

  executionxwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Drops file in System32 directory

  behavioral1behavioral2