Extracted

• • Target

    msedge.exe

  • Size

    213KB

  • MD5

    03e10c70b1f8927870b855501609be5e

  • SHA1

    e8232b79566b79a31f5c2d1e0228c4ce15fed06f

  • SHA256

    8da78017f088bf2a715737d6b66ae49e01f1d5e9f470113e69b1d467d673f5a2

  • SHA512

    e091d3e904e52739b3897f09dc6ee68b555ad2400dc2d70e5afaee1b9cc46b68c545cc841f025e0aeca7b9dea3ccd5e7a5ab8dd3597e4dbdc5c51ab9ea6b484a

  • SSDEEP

    3072:/6u7K5JYwXb04bmvrRjnHOmA6DRUGKXs+S++7KFSbxeY+qDDrMK:Cuu5JVb2v5CGqStKEbxI

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1