Extracted

• • Target

    6f142145f7fe5028de2f33b56b2853347c2b4774d9fcfbec8547de1029c57f74.exe

  • Size

    49KB

  • MD5

    0b3fc6003ed631b572c3347e10ac4aca

  • SHA1

    51abe8c42abb8c2c52331bbdb99eb2fbcf18315c

  • SHA256

    6f142145f7fe5028de2f33b56b2853347c2b4774d9fcfbec8547de1029c57f74

  • SHA512

    3df3d20f0d96a122ffae5e54067864d8349dc0672cc24ad94dcab3ac67dec8c520b4f6f7875d75af14791180bd28f68ff4252111fe6c8a242286f9dd00bc751b

  • SSDEEP

    1536:G4TlXi94kgMLEhNkoyIWwClDVC9D2XPs9Hy:F5Xz3MYuwV9QPsZy

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2