Extracted

• • Target

    rayt.exe

  • Size

    71KB

  • MD5

    93cf6a22a726178ebf1f234c39434c98

  • SHA1

    42514ec5b65967f84c52a6d205dd7711eee8b341

  • SHA256

    bc93a47532a5d590cc44003f2b97288d9313f640ea4c5efedd08f24b30352a43

  • SHA512

    07cec1f11d16368e8ebc23f4cd62215e96f08c988e25c1867440d4b64560874f03bbae830c07295ed53b75fe0b27573d3a6701dc4a1879a0555569eeae511883

  • SSDEEP

    1536:p3Bt+oepi0dGGPstCQXgubzu27z6IQAOLz4NCj:RBd5GPsJbzDZ1OLz9j

  Score

  10^/10

  xwormbootkitdefense_evasiondiscoveryevasionexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables Task Manager via registry modification

    evasion

  • Downloads MZ/PE file

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1