Extracted

• • Target

    xdbabykai.exe

  • Size

    66KB

  • MD5

    574f80e11cd6dbbf20ed6fc1d5ebf986

  • SHA1

    c8cc32715ba8297c7a144423dd147e8f8375baee

  • SHA256

    e37402a9a7192a5c341e38c64713b0f4bf963f44f0d2003a656ed64ef3fd1c00

  • SHA512

    6b40cb751ad6c755461f8959272123224efb5b4245af722c40972d3b333cdd68bda718a32dfd462b1952f1b945f75dc483bd082d2dc0da406affec9fa0bd88a6

  • SSDEEP

    768:Lqpemdo3SEMO3v2hAHWkQiLYEbLf5KSvs+HWK1Pew60J/pOK573ghDJZ04hq:Ll1PM1iHWi5bL4S01Kdb62pOCgl7Pq

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2