Extracted

• • Target

    VoltPerm.exe

  • Size

    5.1MB

  • MD5

    ddc021bb45ad3c2cd95e8bd3f16e75e5

  • SHA1

    2d120858e62783aad9fd85deeb69662103495658

  • SHA256

    71a5540785d034b98d1122433dff996ab311faf0b57d97f398f745122d68b70a

  • SHA512

    eb1d7f62a373f66590f9341b6c763d4c561d1863875392e35db274a546919a7b3f516efa69f010def6e220c3f6613ad5a1ef66f2dda7eaefe5e29feece45f91e

  • SSDEEP

    49152:vYOhZAqZLFXpyh4mgkmO7EWrj25MZ4VZvbk+B+B5EqG1qbZp5m6XH:TJpCUOYC4VZ+ES9pw8

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2