Extracted

• • Target

    Calesial.exe

  • Size

    167KB

  • MD5

    dc87a72941b6080c4734c0c5d1ddd639

  • SHA1

    2c28fcaf49352ed9eeb39137c1157831d3f4bb14

  • SHA256

    adab3bc3b5ff06815461229d47960f67233e74a6e7771b80849956d8a1f3f603

  • SHA512

    122e2dc75d332b507c0f33cc8a1726b475bc6552279b1a64acba55b939ac8c3760933b13f46842096c23a5d604bc2af1bf2dc3dc224ebc8ea8db8f2eefd92e9f

  • SSDEEP

    3072:BAFLeHHWR38aZWbVQSobUzLOD57uvBz65/M6If+3Js+3JFkKeTnX:qlBWbmSbvxBt25

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2