Extracted

• • Target

    Dice Roll CheatV2.exe

  • Size

    23.3MB

  • MD5

    99197c50cf777691f85ff76130c29186

  • SHA1

    885a312fee977b740c1100e2091444695da7d58d

  • SHA256

    e63b97535e194d90756cc01a322550d4fa41a76117799a798ea0a78c6dd940bd

  • SHA512

    cbfd7080ddc2fd6094d0882da1e9e94c439b9fba6cf7935e45410979c24ebbab372f02e4665b226f829d1a2300965d1278957a2f24d997969f8db37e8091522f

  • SSDEEP

    393216:9XlObdJ4zYDHwWk5FqBJF/hGn7RcPR5jHnxtSKzfZgvTbbBUcfs7GOa:1lIIYDdKFqBFGuPHTxcKzfATbbBf

  Score

  10^/10

  xwormdefense_evasionevasionexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1