Extracted

• • Target

    Dettex.exe

  • Size

    81KB

  • MD5

    0ab285aa5f65ba0bb9ff099023be10dc

  • SHA1

    0d9bfc0f2960bbec8f2726407ccdae2e7aea689c

  • SHA256

    59a4dbe0a20d2ad82fcdf2a600ece029b7128688df78b97a5b61ec9aebc5eda9

  • SHA512

    71f4a5da6ef04c62a5e651e0afe155886d7f17e9255f676d481581d0a1ac0074f9398eeddeb8629429411104481c459cf504f52e4f0f32ebf4f2d84afc386f03

  • SSDEEP

    1536:n+DqO6GY281xzboJ2U/0vewbL7MG1DB6wnoO2yumExThRaA5am:86GYpjbP1bL3bnoOBylRN5am

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2