Extracted

• • Target

    2025-01-25_b11880b38458221400f1c8b92df47ddb_hiddentear

  • Size

    111KB

  • MD5

    b11880b38458221400f1c8b92df47ddb

  • SHA1

    5a6d2159638a0df26f7333f9c3a308e75686a621

  • SHA256

    2b7f6704c417c0424c5b300368e94087b5b698ca33be4c2ef6e5b0b843dc0c32

  • SHA512

    0b6e9e6c9a47af57523a6e63f0fdbceaa5f0b2ced79150dd154e72339b1dc2547da51693927a1b5200b42dd4e20c8f9213a2d590864b2196ea8df0f3efd8e357

  • SSDEEP

    1536:BAMwflmsolaTIrRuw+mqbz9j1MWLQsR0F:uM+lmsolAIrRuw+mqv9j1MWLQPF

  Score

  10^/10

  discoveryexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2