Extracted

• • Target

    dsad.bat

  • Size

    122KB

  • MD5

    966f3ad6d9f5ad03afbef0a7917cbede

  • SHA1

    5c62ed021daefb494d236017d5cd5110928942a0

  • SHA256

    45e0996bc0c167dc427891ecc287d98cab9a5157ec74803c8873c435067f42f7

  • SHA512

    0774869e64b20dbfa503a65b3c40b0e1ef15cfba16078a9526da7bacf46a69636be2bf52dc20ee6f502d59dabd76ddf6a088ce85e931b20f4e9094017a7821ae

  • SSDEEP

    3072:PX5WdgyknI18fbSRFmj53iT4GgV/POVuAQDXiriToJl0:PX557y+bz53iKOV9QDYi0Jl0

  Score

  10^/10

  xwormdefense_evasionexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Deobfuscate/Decode Files or Information

    Payload decoded via CertUtil.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1