Extracted

• • Target

    NetCompilerCShrp.exe

  • Size

    1.5MB

  • MD5

    c125697bdf4aae54fa53be4e772c6a49

  • SHA1

    919afec0cb7a46024a221c0c02721eca753ccd80

  • SHA256

    68fb0d6a348b6962f02272a0f8018a83ab69576f09729bed1af975bb9b6544ea

  • SHA512

    6e8b95b8aeae30ae09ff4674bf8f173cde38d9f5fdd2cce73ca694d1e2599f24cb81870f862cb77c8e89a271e8d5aae03cc82a52663727fca70577d166602488

  • SSDEEP

    24576:/MeoskJNFkm0deK3zuRCLg4j43tpikJ8eTgOFGR2QRR0dwY1gjHq3V4:RkJNFPorzuRCLgs+nggIRq47V

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1