Extracted

• • Target

    9191db1559a20a2ad8669bd6b292d812e5dcf6bd9bd1c3cda6f19b5c7d390762

  • Size

    41KB

  • MD5

    e2a910d4a1892763c150104344e43927

  • SHA1

    99cb1241cd9b04ac5486fe82956655b7675c5495

  • SHA256

    9191db1559a20a2ad8669bd6b292d812e5dcf6bd9bd1c3cda6f19b5c7d390762

  • SHA512

    4276e4928fd984a7606d62c2c7789a491bb5489f1d54c5dea9f6ccfcfff96c50972df0f92bc0ff899d7e0e43ab0d49b287c7a6e0f2be7b5ea92059626cbcee0c

  • SSDEEP

    768:NpCFe60PDoSVyXkcE6JYXDXDcx1DUQqiuChZNoAko4o0SO4iOth9qEhfC:HCFevvVyhE6wDsuiMA+ig09qx

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2