Extracted

• • Target

    tool.exe

  • Size

    262KB

  • MD5

    3a5caf979b458f716a670e49ee8c4cca

  • SHA1

    80f20a21284752096e93d0a99a243e1cbca7d458

  • SHA256

    b6253c0d16bb1f326958003cf456382dcb1876f4519519b6b39676ee369ac2fb

  • SHA512

    e00a5f7753f6055766028fe38f780d04c02b74d6852c0e6b684001740d3d942349ec03d7fdf32af543f2b2cc1f8b241dcb87e3b52dcdfcfa3a08f96f69bddb81

  • SSDEEP

    6144:ilejaU5gt8SYDRmGWp8Vu2PD9+W5reXsC24SC:pjh5SY1mGWpw995iT24S

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2