Extracted

• • Target

    nlcs2crcack.exe

  • Size

    165KB

  • MD5

    ccde94532dcba460b2d44773998c3021

  • SHA1

    598c90a91be55aa76532245018e2e997503c32e0

  • SHA256

    d1029c3fa13d882ac717748fa973d8904840d8b81956979d965a8f3aa2921bbf

  • SHA512

    49211f29ddf8bb2cc059bff5f4090f876c9d4948bd5ba06ba5249aac3318ce29c7c11f4edf73f31f8c4760fe6e7dde323e0845faff9397014e3dd809c76db50b

  • SSDEEP

    1536:bDIHj+5GGR9P5RtNOQLbUWw3VaHf9q6qSOCX8pazB4YiX:bDsjyGGTP55OQLbUWwI9OCX8gzB+X

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2