Extracted

• • Target

    BootstrapperFixer.exe

  • Size

    74KB

  • MD5

    aa65192e44a3bda4ea039571429abac5

  • SHA1

    e1c8f9861e01d1b042d7267c5d7a6b7562f05c7f

  • SHA256

    03015c4f39849613a41ed43ed036ad274f80d005509177fcc902c80a36bb3fea

  • SHA512

    0e48d517c8730548497aba3fc99a1baa38f640e9f46f8061ac3f8dd9cb47eb5bfb0bb5daa24ef690225112b748b926ed3449623764f400b3aa2705f3987ffa3c

  • SSDEEP

    1536:/AySegvs9JRF1AFF9lr9bWsn7D9U64CURikOh1ATt:/Ukj1AZ/bWODsCURikOLmt

  Score

  10^/10

  xwormdiscoveryexecutionpersistenceransomwarerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1