Extracted

• • Target

    c346655d32844eda0a9ec3d3d9b16c1c27248bda424fc8b91804d26cd8986454.exe

  • Size

    77KB

  • MD5

    a307d64f791cb555d029c214364162d8

  • SHA1

    04f134fd1a0b71e0b4b745a97e9a08ed1ee45c74

  • SHA256

    c346655d32844eda0a9ec3d3d9b16c1c27248bda424fc8b91804d26cd8986454

  • SHA512

    d432bcf7874ea3f74ec7e4fc51b400f7c3492b06479fd12949b7cde698e513bbabd08afae8d0ffc2efbe3d7d0cb44e08c5b2bba3f116b9fd6120713e2cd5f96e

  • SSDEEP

    1536:x5sFO8g/9VM5dQ+aomobhr3KXg6wzOB1SmOnU7Ua+G:x5sU9Vv4bbhr6SOB1S5nU7MG

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2