Extracted

• • Target

    2024-01-10-18-19-14.bat

  • Size

    79KB

  • MD5

    0a2db837a415837ff64d570e9248f079

  • SHA1

    10752d7b2a8f997ef1cfa73ad3675bb54600b18a

  • SHA256

    3ee2fd48810d44c52854df63b99be9b5e4ef60efc70852b2e1672700f9a3c5a0

  • SHA512

    dbc46cae96b51c64315446b369552a41006b96a53a8b56bde9bf262ad9ec93958b4485b67c85fee0b93c60d8cc9b83b850a4c8b618f6077f5ee1605cebc07523

  • SSDEEP

    1536:Au+JxE8lRyMiOTHXe99l4BlRB2LsjT0YQNhKcQIoO9gkMtdt0hFJ:APV3ex2yMA7vxQIoOradU

  Score

  10^/10

  xwormdefense_evasiondiscoveryexecutionpersistencerattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1