Extracted

• • Target

    8baa976e1af785175342dd4c126e65d2e12839e77075090f79e2053559dc5743.exe

  • Size

    141KB

  • MD5

    67386c0bb06720e6c4d20e72887a504a

  • SHA1

    73188a12aabf0d683d3b8d791d4933296d15e2c9

  • SHA256

    8baa976e1af785175342dd4c126e65d2e12839e77075090f79e2053559dc5743

  • SHA512

    a8139eb62a2bc7086e0df9f30fef56333d1a6588cc69445524001e048bcb66a11067759f96b9d85b7daea78399292fd9972adeb947228c1080dfeb6b9db1b5f9

  • SSDEEP

    3072:XhgNVe3HGJ0FK0jRRWI/FrDfOYIr4rEPnB5qgTCZv:XhgNVeX0MKcp/q4rEPnigW

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2