Extracted

• • Target

    WizWorm.exe

  • Size

    100KB

  • MD5

    314952857dbaa3f03c09355737b1d2c6

  • SHA1

    2da8d4cceecdc52609f34ee6adf5876bcf6cea94

  • SHA256

    4bfe2784c6339e3ec2bbed7c751f88106524516dde2bb249a29b0cc883ff6a34

  • SHA512

    7dd9cb1152ea82a1e83f65b3e98071e30bdcb494f61362255d2301bcde227b9614548f182a179927be87c9b521f4e8295bc7a5ec78c4ca6132f38b445d0a839b

  • SSDEEP

    3072:hH3WH59UsdQoP4iGz6v1DLgMrwPbWPsqoj:hHmHwYP4iI6NUMEPbWPe

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2