Extracted

Extracted

• • Target

    New Text Document.txt

  • Size

    261B

  • MD5

    b7d1dea96fc88cf58391d928a3558e32

  • SHA1

    c4a5be1b46c579c8405006c7da0b672181e90403

  • SHA256

    7d83f37893fa8a17d42fe040878b30e1015286849931be05c60c908c3759d576

  • SHA512

    08b08f2bf4f735c673f550c432badcf42e625e240971b78b8dc5d5c43f48076196aac44926882e4e0483f122a32c6633b6d57467e05ffe30fd5ee4190c351572

  Score

  10^/10

  xwormdiscoveryexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1