Extracted

• • Target

    Output.exe

  • Size

    100KB

  • MD5

    440e99fa2695592de7acddebcde9e87c

  • SHA1

    a5fb9a09d6221514b0534d53899a745ae0113487

  • SHA256

    766d4211a15e33590c533f76bcd7436457088f9d1425f4035051a7e84c919b35

  • SHA512

    cc93740535c5eaa7910fdf5df58c5b4a7103077cbcac6ef3905179be3feb55266e2c464ec605e21373ed632e31a7ea29a724b0606904a1350d35091f9af7b94f

  • SSDEEP

    1536:kWJXbxecjQSbDbwZPmyKqlB7kxrEYq4tGqqAErfnz+z67w48nloE46SQpEX:kWJXblrlMar4zvz+zyco16fpi

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2