Extracted

• • Target

    FULLOPTION.exe

  • Size

    4.7MB

  • MD5

    9907f1198b7ef415b03810f28cd1b32f

  • SHA1

    df6773b58ddd0de1bad25ce141431b1805011ea9

  • SHA256

    16b9779bc79413bbfa3194a7cf406635548c03b4f7ebdce230aa88dc6bf01da0

  • SHA512

    4dd1af5964cbc6fd3c3f1b4ee3809d4286d193e9f3839599ccb718aad150d460fbeffa592e3d5b6d45c717c5328dd48853e7fdbcc4e8e7613a8799d05f20b474

  • SSDEEP

    98304:CS183Lm2l1laOmBSHmhRMI7f/1Z6p81tznH3AHI2O9eoSSM:CS183Lm2l1laOm7zdqCtzH3YXo

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2