Extracted

• • Target

    special_function.exe

  • Size

    4.1MB

  • MD5

    5583ad2b12d90490626b14fb72471ae4

  • SHA1

    89200b1ea2cb8c22b97f93b335d861a7e022478a

  • SHA256

    7f923d21aabce586b418237b335c8f0fd2e82057bd7f3119804a075af0bd4acb

  • SHA512

    4c198116e8bf52f8aa8436e38a2d30604267260f9d74a2c2b6ecf9fdb40d3e0162a34894752ef0cc6b496300cd6e62149020340317cc949db8bf747b03f7255f

  • SSDEEP

    98304:MW2uRdZpGWnfsRnOyPnbK+4AWvxY24eY:gudBB+0vxLY

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1