Extracted

• • Target

    415abd7fb89262dc08b47ed0e322ba556b764f331d33e6b96da9aa3bd16c985b.exe

  • Size

    540KB

  • MD5

    16dfbf67c7ef26c033309725e495ce48

  • SHA1

    9dc8e5216008218aad719808c3af85eed3634d98

  • SHA256

    415abd7fb89262dc08b47ed0e322ba556b764f331d33e6b96da9aa3bd16c985b

  • SHA512

    0e52f5b398c28d32b96725afdd897cfe39b2b0506b084ecf75e86419b32ecd87592af3c633c15c6895fbfee1132fa507bf02b801bf2d17401ffc4415e4268525

  • SSDEEP

    12288:xtH5NLaAdDhAAEIFcX+tb2NGi820zTMk9JVRrqZ2E:xtH5sAdXEIFJ2NL50z79JVRrqZH

  Score

  10^/10

  xwormdiscoveryexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2