Extracted

• • Target

    2025-01-17-13-06-51.exe

  • Size

    83KB

  • MD5

    45b9c22e416482de6446d6422f37fd17

  • SHA1

    7db3bdee144cb804d73ecb8fcafa4748024f67a2

  • SHA256

    fd96a23ae800a272e8bdf46dba1c8a3ac285cf1c7f6c6f5ae4b473a00e3cf43d

  • SHA512

    731ea90275dbc39ac0ad9c16afa9b61488d5a6ff5a1fbe5af7800a7a38b54b4623c26857b4caec2a5c15c4afee788bc98215ce22ce9764c44e8d90b698e5ae03

  • SSDEEP

    1536:uaPkD+QdQoTFuUer5QhORVx/KzNHUSWUiuCLWm2XiZs8hfNG7xEa1af:uQ89lfo/eJWWCLWm1fNkGakf

  Score

  10^/10

  xwormbootkitdefense_evasiondiscoveryexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1