Extracted

Extracted

• • Target

    All function1.0.exe

  • Size

    1.7MB

  • MD5

    aa1ba3c905421e79b13645c9c8c81135

  • SHA1

    da44103f2f45d8818c10fa2269976ea826c57014

  • SHA256

    a5e013b374ebc919d925619516a0191809e385819223d324900da126ccdc0a87

  • SHA512

    9bfa9d7bc0de40f3d0e18d0b35226a1e39abb0fea10ba099a4476ae18a8b4382d096c7bd6eb03f49c3a7b567674b7a4e5eb8d31f66c8010a30e076ba8a263a93

  • SSDEEP

    49152:DBr7VVvutuINQ3jKRq8qwnU5osLDlK8j+0:DN7q2TKRq1wWos3lKm

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1