Extracted

• • Target

    Nursultan.exe

  • Size

    491KB

  • MD5

    d326a49628c02672b8199e2d7f6eefd6

  • SHA1

    3d7bfcb1055df6d9a99b9a861735643d979dbef1

  • SHA256

    78faa3006a538ebb08d194b94ffaec25e5a704a40e0aafa533f3e5c538d453ad

  • SHA512

    95be9d339665ac48bce1e09de17e85f03bc6e4cbee590a2d3fa6f134ae63cacd1b995f7a9d929105fbbb81f3f31c5d77eb6f1f7d1fd0dfee0c07fd9ede5c52d7

  • SSDEEP

    3072:qaXN3R7KFl0QuPcwo6AWDw32wgD29avk48DosgRARZKBzcoFRJvmFdJZJbvRNpG:lN39QIjHDC229avr8D+WKzjJ+FDH

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2