Extracted

• • Target

    android-evon-mobile-executor-roblox-download

  • Size

    9KB

  • MD5

    7f8ee050d779dd287baec89600d7c92d

  • SHA1

    0757aad5e1e59d165b3b335cb630c1c77e6c177e

  • SHA256

    1ab3ff2824b6f74e483449230b9f9ccf1c4ef45b787ab2753c1648c9c32a7b5c

  • SHA512

    02c2041ce5cd33671ba53f5d6cf272debd45928c8b5ca93f4b8eb62a9203117504af10c2a1c1de031cb739007271e1210de79f89d0135e18f71ba00f23ff0dd3

  • SSDEEP

    192:PN2x2BMup0UJklqjKYzCAoDqkvKa5z73FzysN:AxpuKOkMjVNoGMftBTN

  Score

  10^/10

  xwormdefense_evasiondiscoveryexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of SetThreadContext

  behavioral1