Extracted

• • Target

    rizz.exe

  • Size

    62KB

  • MD5

    048352400d332945fe8dbc5c03183481

  • SHA1

    1e475837d941c070e51cd27262a07d020f74dabf

  • SHA256

    d4bf492ddebe96953f2f7b01345a2db570ac311f6533403e103b8c16a323a3d5

  • SHA512

    0a08819c268b6656a1c1757c0b0ed0f0fc2029cdf0fe380668948309748303281ad7e44ccd73563485e6b9bae624bfd292a66f41eb0460705e5735270166ebd8

  • SSDEEP

    1536:uY8A78RZXhdNXhUMXbyhNgao6XZwJENOLMByV:kRxhCMXbyhNfwWNOLMMV

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1