Extracted

• • Target

    B0TTLE.exe

  • Size

    339KB

  • MD5

    e0d9d67f2387df7ffd3b02d022eed5a6

  • SHA1

    6b4efe7a39ffc77840e9274da19327fa878f5c3c

  • SHA256

    51ae0b0bfd3aa9eb4009aaa96528ba5db3a716732ab67206f6626a77180e2a7d

  • SHA512

    0e12e16e3eaacc0d87297fed55b58f5a16b27d88d14f73b9aaab66dd7a7d2301bda487cb5f04f89be0fbec2dfc5203280107313b7c1fce80b680af2b2a378bd8

  • SSDEEP

    3072:oU5zftF6SslXjgxzi3Z80WaXjTPbUiS75l/NTugUJV21KFpwqEBOrNoq98wSpvbK:oU5zlFJslzgxAZ826SlQqrR98XU

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1