Extracted

• • Target

    hiii.exe

  • Size

    82KB

  • MD5

    471df0297416eb4d460eb23ae23715ca

  • SHA1

    01c40be91002180c4298ecff3368e1006a9a51e8

  • SHA256

    0bd0d98f307f71fb3e4d1e529f43ce88b467e7680e913593c2ded88497c76922

  • SHA512

    86bdb0569a2b6a239ffa2e0f0893fc581f2c9492c81844dc7dabc6e9ee4342ad9c4784a1ede947c882a13fc3d40601fb65e1f6b0c06cc04194e7fd1e8dac56b2

  • SSDEEP

    1536:cIcjOqaGSFhad0wC5FwJH44b9n02hdg6GQ7OeMXth6ddS1EAd8IIZ:waGCnwC5A5b9Fdd7OeM9MXgEA6IIZ

  Score

  10^/10

  xwormdiscoveryexecutionpersistenceransomwarerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1