Extracted

• • Target

    XWorm V5.2.exe

  • Size

    206KB

  • MD5

    45e3e7d34576c7190778858e3634c4d1

  • SHA1

    cd570c94fe0f0f0c701b688ef0aa68aaa7589c30

  • SHA256

    a2cc3be38b094728b2e63c87cc6041316bc5a52a326877626d09f16746abf95b

  • SHA512

    0a763390ad047746a06b1fccb08f12c47d228fb97e55f20eda5394bcbba26ed06ab2441faac5007cf43c3ecb291729caa91539a1a9071bc7133ebf8fcea4d153

  • SSDEEP

    3072:EMmgM4RbNQJFltOqe0GuA2ewhLapuvpAsZOyMqmyBeYVYX:EMbboFDGO/GWGwqqm1

  Score

  10^/10

  xwormdiscoveryexecutionransomwarerattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1