Extracted

• • Target

    aea379a3fa117a687c63457d6cc3c45d08673250797cb81ccccb88ba52e3663d.exe

  • Size

    39KB

  • MD5

    89d4deb1881c01e8534f7e8ced625ee1

  • SHA1

    c3d98a081e99c46fed7d7ce8afb075614cf9897a

  • SHA256

    aea379a3fa117a687c63457d6cc3c45d08673250797cb81ccccb88ba52e3663d

  • SHA512

    bfbb52c54f8a53447cedd9f61b12de90bf239a9b259cdb03df16862fa57d29babb19bd490d3b1c463fdf31712f089d4b8a4895f8c45734e0cd147dd164a88f1d

  • SSDEEP

    768:EBj78fx6MooHKBjJfDUbtRFH9OKk6BOMhYL05jh:A78p6MLqBjJfIbDFH93k6BOMqkjh

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2