Extracted

Extracted

• • Target

    MasonClient.exe

  • Size

    43KB

  • MD5

    057f6e706df8a5c267fd6695ab1502f2

  • SHA1

    8ff73f496305d8c9d20c59a6de47df3b6934eb6f

  • SHA256

    aa8b18a4f3db53e54589e2ada92a147219ed8a8a2cf92ebc50f8a670eed226ef

  • SHA512

    f8124aa2784184bae9e49116f4f9c11922ae75e04f53a4ea2db38664d0b316052977e39ebfc473ce1649feada201e415b707aa1e9f7dbbff2d233669a7bb63be

  • SSDEEP

    768:pRg+rDjLP5U1b9foYPRhlzd6aO9Zh5AuffEx:pRvHPUb9wYPlB6aOTPkx

  Score

  10^/10

  executionpersistencenjratxwormbyabolhbrattrojan

  • Detect Xworm Payload

  • Njrat family

    njrat

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2