Extracted

• • Target

    AboMena.exe

  • Size

    556KB

  • MD5

    49db212c0dd5eb04e850108b76fa9e04

  • SHA1

    892352183d14420c46aea5071a9034d316413882

  • SHA256

    e5216ebabce28a8f5dee3378eeb810aa83a12f038f9e1e9e41a467c9e85eda8d

  • SHA512

    4844fb1fd45cf551bd988ee4199ad03fcbb4fb774b91f87ff5a86e64c3fffb92f5d2d247a7f064f0711df5910a4e14b8a42539bd7115aac53801240ceea0a373

  • SSDEEP

    12288:O+A6H75ktAVl/X8pv+2INMiVZjYmOOmxJYeBhy1BeQT3K:a6qtAPf882I6+ZjYmO9mWS4QTK

  Score

  10^/10

  xwormdefense_evasionexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1