Extracted

• • Target

    https://cdn.discordapp.com/attachments/1345482930600018010/1345484285460742255/exploit_2.bat?ex=67c4b763&is=67c365e3&hm=06eab45726494c005f7f778a126193c180656c8923b4b0b78d31113e74d0e4af&

  Score

  10^/10

  xwormdiscoveryexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1