Extracted

• • Target

    d0877554e828d2ffd5c8592256b697690f578818064c0b028117fed0ba64fdf3.exe

  • Size

    64KB

  • MD5

    2f994e4870a23f49fb779d1bda780941

  • SHA1

    99b8dfffb69ec2b7193320a7f8a08b7da64be7bf

  • SHA256

    d0877554e828d2ffd5c8592256b697690f578818064c0b028117fed0ba64fdf3

  • SHA512

    9138e89454f9f56a0540a33bccc8e62710a447033e6ea53732d625b2b7635a973c7308f86dda5ff60c1a80c00dc36428ca0b9d9fb590f837648a9dd9b5ea7e86

  • SSDEEP

    1536:+EVRBKXfmrbLO+BBUsbJU5fRqw6LCLOO4wH/:RVRwunLbHbJUNYoOOrH/

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2