Extracted

• • Target

    Myfirsteverloader.exe

  • Size

    1.1MB

  • MD5

    f2f18ce75b86858a4d8e0a0e421d8449

  • SHA1

    3e7f78649ab0f5be4167ee69b02183d453fbc761

  • SHA256

    7826a953fa1e5a6e621c2eac162cbaa9f11527383f300ec0c5b00558d646c342

  • SHA512

    8adb552f355d03f11747de1abf3ee08c66008fbdc47459398321d2937b87f5195364c31bb8f978eac45a121a74d55d48b4741e8949d0b904c2f9dcb6334f2ecd

  • SSDEEP

    24576:d+nWTMOpbka+JoBhC5CvNpumT4ypE8NZpKD4Q5z36NyDwnU:d+nWNtkta7KCvNpumT4yK8NZ8DnW83

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1