Extracted

• • Target

    Loader.exe

  • Size

    29.3MB

  • MD5

    54fb546b537e9e4efe685d60565b3008

  • SHA1

    81cb60b39b7a4c6abb5004b90351dbb23f80da58

  • SHA256

    24969dc7438810f78b7c98da7542d9925a7f1e327b54eafb475d20fbf47b8ade

  • SHA512

    4e220910c66b9f131f655884cee2fef239e4872242de09ff5de6bde9a50ccd3b448a6c7578e7c3cbfea851f97f236937f11005a5642bf1222b01fa74699f166a

  • SSDEEP

    786432:RutirSLniIrHESgG8VGC76nNLOnx+F5GjMgbeoOmW0uEpT:Rut2SuWHHgGCQN6nxOsjMvhmW0uEpT

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2