Extracted

• • Target

    ExperienceCheat.exe

  • Size

    62.0MB

  • MD5

    a2758f6c3f1a1d68731991792a711dd0

  • SHA1

    e2ef709aaa1d88792d54b8cf05b9b3c3033b3409

  • SHA256

    ca93416a5406c488c52fdda404b872f0da81f9a8459f4d4ae4cebe6541d22e85

  • SHA512

    9fcd549b1dd8bced2b1f843272a8d923322a3ff4eef05d3bf8fb7a5cfd4328a36192c04eb1e6e16d799cefb461256cd8fdb772bbb251e94e44338c242d463103

  • SSDEEP

    1536:YkeHtRfrimdNmkKZr311OGAiQj39IdcCqcAP69nQ:oHtRp6r311RAzj390VAP69Q

  Score

  10^/10

  xwormexecutionrattrojandiscovery

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2