Extracted

• • Target

    572667ee8147be27b09a4b68b5aa14cd60bf2e25a2a1a09264f94a329d37ff80

  • Size

    75KB

  • MD5

    b923f5cc55cd2026709dd9cf2769a774

  • SHA1

    72b6dc0ed5f068c2f6caffbf25a690c416df334d

  • SHA256

    572667ee8147be27b09a4b68b5aa14cd60bf2e25a2a1a09264f94a329d37ff80

  • SHA512

    cf146b11d49f4de41e0eb40fa6a6aac489dc11ad0cb2a918298e6c6c955ebcd280d8530f92f2428e67ffd0a6c5f5d6c054b760337a6e27209d1ce23e5d55a959

  • SSDEEP

    1536:/2Q5pJiB6uawKjPFNN3GOU60s6wBecnbSxa++aD63BsWF/GOGAWYR:/2Q5bi9bA4cnbSE2m/GOG0R

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2