Extracted

• • Target

    4d34cf65213ef8daae214f5b969fd05203e8ab2eb871ba76ba8382950326536c.exe

  • Size

    63KB

  • MD5

    32a5e227422369d29efe9899fa7f1cf1

  • SHA1

    b8292a2a80b5b78f68b2b2b2b561d2926da81afa

  • SHA256

    4d34cf65213ef8daae214f5b969fd05203e8ab2eb871ba76ba8382950326536c

  • SHA512

    1365b519c5e70bab0ca7319c8c0dceb6b428c89a793936e0708732de3fe1d77ea458bb5056fccf55f849a07964e7e937cb55ff2d0f79a464f1926e464ba31ec0

  • SSDEEP

    1536:SIfKqlxoqCjVQVw28BBgdE9rIuVO/KbHEMaDdnYi96jdtOU3iKU:SIfKCxCjj20SdE9EeO/KbHEHRvCtOU3S

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2