Extracted

• • Target

    uhhhhh.exe

  • Size

    67KB

  • MD5

    3083acc11f7831e5dd4d17f57629e0e8

  • SHA1

    5f8a1bc143cb1358033050ec3bae36ae7b8ca051

  • SHA256

    14d861ab3f84d09ad5b4fe1936b1a363ac513416bbf5f561cc274b7238bf063b

  • SHA512

    6042d29e295d0fe52d3213a0f8efb11163ab03afe4e272cb437e6f543a2e7e58679d6950ef8a79fd4b1d1b94ff3d73467b4ba623560d5af27e7d69d41994176b

  • SSDEEP

    1536:P3YtrX8iPmi24ysDbA+JcgKID1REW6cOl9jyS:P3GPmpRsDbFc0D7ROPmS

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2