Extracted

• • Target

    BootstrapperNew.exe

  • Size

    3.0MB

  • MD5

    d689c61a3e256005c7b08f6f26f1d337

  • SHA1

    954247af9649cb70872e92da3dcf98d8efb45364

  • SHA256

    49709bb94a666f4430453283645a3bb138e576304af0e00682b3301a26b8cac2

  • SHA512

    bc627ebc0a0b418e1e4e20237d5b45f02d8617559fe49b160f7fc3432b2f501c5bee095c7ac2bc8785a97e20c80feb53e23d234ce5af1a598ae3e1060d440ac6

  • SSDEEP

    49152:SpUqO2fRme5Iqki3W8ZPQYzwEC0slQ1nNbYl2FrQGGByf20EGNk:Spvf5pkeW8ZPQgwF0sAN0l2FrQGG+E

  Score

  10^/10

  xwormdefense_evasiondiscoveryexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1