Extracted

• • Target

    5023bc998fa00427629fe99f21f8548b66ea3a36c38dab80e37ed08f4574c409N.exe

  • Size

    75KB

  • MD5

    d82d609d941466764cbeae3ef647c470

  • SHA1

    12bd723e0ad949b401c64e82eeabad0796c05f1f

  • SHA256

    5023bc998fa00427629fe99f21f8548b66ea3a36c38dab80e37ed08f4574c409

  • SHA512

    d085a4c4d97d659104048dbd55c0c35a4b96749ea09b3a843c29b9738197452e1c2245828dc7cb3b20c96035c1ae6181727671418e4eee00e11e30f7c7595103

  • SSDEEP

    1536:WQvlvzEfcn5PF6vWs6aq69eq9bC29104DTcp7i600xPCOMQln84l:WovIfk6OYRbCaSacl4OMul

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2