Extracted

• • Target

    WebhookSpammerV1.exe

  • Size

    206KB

  • MD5

    c669b7aac0c6d6e5a2b09fa060835720

  • SHA1

    cff60e01094fa203715b76820c1b37a680381108

  • SHA256

    abf05fddbb728e0cf67da50245a63c28b383c3d50573b3c96cd15032d0af38f5

  • SHA512

    d4ecafc845ed6430bb802c18811dd79227e568e9feef12dbba73ee983b98b1c87002c3e62ab5c39278dedf4da23ce16ba007dd970a564a6d87acaf1e692f803a

  • SSDEEP

    6144:gm8K32BN6NqV27EG8oMa0UpLaAFMJU5Ma3qjFRlqXwmXRen:g82indvsa3qjFRlqXwmB

  Score

  10^/10

  xwormdefense_evasiondiscoveryevasionexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1behavioral2