Extracted

• • Target

    XBinderOutput.exe

  • Size

    5.3MB

  • MD5

    ad9d61716f9fc8760aa5d1d3c28c9e68

  • SHA1

    165d4d89597a53e2c08a698498d7660328c82651

  • SHA256

    3137e58a47fb9656c272ed9cec55ab96df6b8e28f11d3942021c44162979dd32

  • SHA512

    939eee8d19a6bf5ba05bb902dcd94005d3b0ae22454033cceb5f191eabb79f914c0002980066e4291bc9426184efff3a4293e937aa51ee299632f06683653530

  • SSDEEP

    98304:GHbcM5mt/pg+qovAKzpFmtalfL5FU+rEh2wFbs0sDmscq:GHZQTgsjzpFmtSLsHd+mscq

  Score

  10^/10

  xwormexecutionpersistencepyinstallerrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1