Extracted

• • Target
    Nexus Release V1.3.exe
  • Size 33.1MB
  • SHA256 9422644a39273f689b2bcfa94551a4bc4815ed9c2efc4871367449051fc7f3a5
  • MD5 8773d9453781de0fbeacf41981bd8d96
  • SHA1 1a5a743be30f2a875aaf95d0bef33cc2ac12fbae
  • SHA512 639dbf4485e774ef89cbca90c06a6d62d3498fd08bbf5eb70def69a18dd62feccb6c4f496da7bc39b06cab5ae0ec2e7949f3acabc318d84875eab409fc3ccdb0
  • SSDEEP 786432:8Li7Hz43sAsAmyb6vA/m8MCiodyuDhJGtucV8wdJ4aqxZq1gjBo:8+7ssAFnbkuRpbyuDrGhVVJ4bq1gW
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xwormdefense_evasiondiscoveryexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1