Extracted

• • Target

    Oauth-joiner-cleaned.exe

  • Size

    77.2MB

  • MD5

    1b29b3bcde010f603e64237893f49de1

  • SHA1

    f06437d63f55947d8de099b9e6687e205cfcd82b

  • SHA256

    bcec20dcac1cf510c5e55e385ec84a26e93d7bda60fd4163708eba9f1e52849c

  • SHA512

    447ceb3be33a12705a663749a0d9259b7d411f5b6774c8ccd8abd3704a70a542b311a68a5903a4b44a25210748bdc233881ce46c696122310f0820262df84d63

  • SSDEEP

    1572864:ScPlC4hahF/gk98Vb7NL5z1ZLWNmfpee7ycbGrswIG6UiYxDVbWbs4a6m:SqLq5ynMe7fKr7rxjWV

  Score

  10^/10

  xwormrattrojanupxevasionexecutionpersistence

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Enumerates VirtualBox DLL files

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2