Extracted

• • Target

    f0d99388ad3f8c9d1dfa1c1f21009f2119519236588b3949854eb9dc6ca44da6.exe

  • Size

    7.7MB

  • MD5

    6f0da64ec09a64c1023210601daebd47

  • SHA1

    8a3f884823e2e0f6812815daaa2649f3d265fddf

  • SHA256

    f0d99388ad3f8c9d1dfa1c1f21009f2119519236588b3949854eb9dc6ca44da6

  • SHA512

    395785cd5906b1abb95fe5ae8a78baafeeea4a7cbb66e7a6c60c927e33e185886cd8ee95fed308a2268b94f005c49ec1589381cf9f4b3911bb5232d38380f78f

  • SSDEEP

    196608:h6GGgRJEK4OCORRpwPtYGfQeK6a/Js6N8imDg+BIu3jpx4hT:8GGoRRI2ht/Js6N83n1jpx8T

  Score

  10^/10

  xwormdiscoveryexecutionpersistencepyinstallerrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2