Extracted

• • Target

    WinlockerBuilderv0.6.exe

  • Size

    1.3MB

  • MD5

    22f77fb76f7478b05dd829e1a5dd12e1

  • SHA1

    69edbca2063b2446fc6209bc4545cf901c83ada6

  • SHA256

    a6fce61792c9ec95e7245c7b76771c984f5e897cb4f35c0661639f197e289433

  • SHA512

    ef7ee6750f58461fd21690e8ab0f43dea72d4a3ab8f130e086f24d8f5c5295a3585947ae697d7aeb5f2bca5ab42b24a804cb50c39e9adbaffb2edc38cb09a368

  • SSDEEP

    24576:qMbXvsRLDInc+3WNyc4aKZQ6VvDrVq3EXcWdFVtV6d/PH:o0c+Gr1YBrNXcEFVf6pPH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Modifies visiblity of hidden/system files in Explorer

    defense_evasion

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2