Extracted

• • Target

    9e908ab143b191502a5ada13123baae848c9c2d6d59b3190d0c2d8ed18257ac2.exe

  • Size

    403KB

  • MD5

    8dafa10561f4e98f68c5ec171b6674c4

  • SHA1

    a41a738fc81df39b2f818f323d0a99bc6d952de2

  • SHA256

    9e908ab143b191502a5ada13123baae848c9c2d6d59b3190d0c2d8ed18257ac2

  • SHA512

    48ab1db5cf80310a6e73b2fe5defdbe111077bdbac09333c22c34ab86a7d734fa0b193d39f4b4a7698ba3c4421b27217a94fbc5bf6db869dff42aceba4d3d336

  • SSDEEP

    1536:80W+2++0XhzUFY9S1I6rOp7Ronkccckccccc6:80W9++ahzUFY9STOp1ona

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2