Extracted

• • Target

    sample.zip

  • Size

    302KB

  • MD5

    9e8a086ef12dda4f5e4bca642526fce6

  • SHA1

    60ee913f968da1db1274cd51a3438523123232f4

  • SHA256

    90a5459c95036aace6e45f9357ad5577ba1265a5a18cbe8e1094726b5299fae5

  • SHA512

    83bbd190667aae5c9a2c01087457ae63227dff3ada7e459223198f95d68ff85b499ee3668c87380ff16d866d8e4d0e30d7105bffec0f368c3a46db74c07e01cb

  • SSDEEP

    6144:tMqXFIbKXyoc5NwK9RscAVGwNvb/Trn6yj14y0nj7IUto8u9iEOv7J1B47m7oQ7:i0FZcfweRscbwN7TrnV1Ij7f1YiEOVLL

  Score

  10^/10

  xwormdiscoveryexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2