Extracted

Extracted

• • Target

    New Text Document.txt

  • Size

    144B

  • MD5

    af335e9be68e6153129d6c23d82557f0

  • SHA1

    1ecbaeebd84c4783c2d644b95158c5ec4f285bf6

  • SHA256

    3014e597f348e41aa380aed3f84ce042a7f5f9113fbeb08c6b6e450555541527

  • SHA512

    f5268391fa1d4751e59901404cd26c4fdc3d982890b80addabd0194b3e5fc8dad747e7c93512bdc60f7274a9a4ee050617dcf9846f9ceb0108b16f9bb99e0336

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1