Extracted

• • Target

    f126b1c0b4ff973d9618b7287d011b61731c2b0e5e9960c72f5ef444288aa8dc.exe

  • Size

    867KB

  • MD5

    a8bd5b655845ba8a23a38abfd7e1bb03

  • SHA1

    90b245be80f5beb8b7b0e50bf910e1b4bff1f1cf

  • SHA256

    f126b1c0b4ff973d9618b7287d011b61731c2b0e5e9960c72f5ef444288aa8dc

  • SHA512

    f560893e04ee817be99c07a42ea654ce3f2ceaddcb3a644094a5316333ce85911f87eb06c10960673d53050e9b4a60410f0c61169c21e203014ba338138ed664

  • SSDEEP

    12288:i98NVBjvwSRz04lj4k/GG6yY5adl8M64mzx8B/wmtilK6yEbx9:vV9vT5lj4MGdyY5SWv4mM/eyEr

  Score

  10^/10

  xwormdiscoveryexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2