Extracted

• • Target

    Api-AutoUpdater.exe

  • Size

    84KB

  • MD5

    e7d61465db5a82ededa06183a6c3f665

  • SHA1

    0267f3612ef089422c817864858ee705b40ad0d4

  • SHA256

    48991778a4ecb77556b3c2110c63c5bc242c79a20ec6205fcff4198118dcf78f

  • SHA512

    6ac7e0892dd1a2cfca163957cfa54b10615f53ff96abc029f7ff7627d2a4dff530fba6078d0a9b4e31b6f9c9f89ef158797e97b2d7d60210dc79b6e7a8225375

  • SSDEEP

    1536:aoJMQoKDp9/NSDM39HKboubUfGdDndBgJdIcMH6rVV/dKFObUPwckjdiz:aoKCD/cA3dMbUfkMdIcM6r/doObWwcZz

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1