Extracted

• • Target

    WindowsServiceHost.bat

  • Size

    261KB

  • MD5

    14be533a8ded237f42b2ddc0d33b276d

  • SHA1

    7293f45cd1cd11f4917f5a8abbad7fffaadbef7d

  • SHA256

    0a7fd6f7e41112d69cab8548e2eb9b6605c43a31a6d69742588c91e96a23b5e1

  • SHA512

    2fa1c126da6765ab7da7663b98498a299f5d4e4c1e92a155add0040ed3e45b32e5285c88d829dc1b87394e08bf8bdba6e1c62de5c749824c69a576d3981c8b1d

  • SSDEEP

    6144:vGnTkbwrZjfz5/vhQnFZTsEmGTNsqrldr31ITpjnFyAKu+:unQbwlz5/enr/vdOTRnFJV+

  Score

  10^/10

  executionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2