Extracted

• • Target

    0e9c3c5d859c50126029aca2032503e01b5132700d0e70eddcb1f008c89d4ab5

  • Size

    75KB

  • MD5

    ad5dfcd8394c609e55ba610617f07aec

  • SHA1

    75c8add725e2343950cec7bde2a646c6ac6e0616

  • SHA256

    0e9c3c5d859c50126029aca2032503e01b5132700d0e70eddcb1f008c89d4ab5

  • SHA512

    1ab34501f8a48533acf0973421e264f02b318ff365f4f69081aff6fc955c4df08c241f9a7cd2c466cacc8021bb4d5fbb6e198e42db8b1cc6da4b2efd91651bd4

  • SSDEEP

    1536:eCVhGPHIES8pLJ0+F7+UAfO4PL9jEZbr6hUoWWaMBcmK8REAe6gFTFOJjvdpeRL:xVhQIEpJ57+5m4pmbGhU/j/8mXO1mL

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2