Extracted

• • Target

    nursultan.exe

  • Size

    78KB

  • MD5

    e495ca1e1261cd17f297aa6b41350f05

  • SHA1

    4998341558a8a5ec170cc704b6f5e05b135ee232

  • SHA256

    bf234aefb0ede34195ea4b45d05df381f0e0a506138c78db7c971317e1550bbf

  • SHA512

    bfb6ba316912222e1056689f4f45764983e4bc408a043db3fa0f225e486fc8ab35359e6b18f68df030ac1b9fd4a8f4bd40edd5bc40879698fdf19edc10986916

  • SSDEEP

    1536:vcNuG9XXTcRmqsPEKCzbc+vwPAYOTm3saz6GBS+gjiQk/OpCsszaG:6nups8KCzbc+okTm3nHBM+Q6OpeT

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1