Extracted

• • Target

    ratka.exe

  • Size

    80KB

  • MD5

    39ffa7b287f2d822703a6deea560dcbd

  • SHA1

    34ae6406ec73ad02955cb7676b37489fdab1695b

  • SHA256

    9465f48edb12c0ecfe182d5d6a91be86afd52c152b61c3916efb09df3a90cb05

  • SHA512

    7efa49f3c9ba846d6382e7683d64a5b00232c459028a177b07c0e4f28f06682bd3a219421a355515766007bee9e0dfcce5e243afba73290487057542a644cc40

  • SSDEEP

    1536:GeKbbG1+cDVWr5hLbwWV5hcEW07Z4E+bCXsEN9qtgq6rLs4ORpmcG1h:GeKbb60r5hLbwWVcPk1+b8JY4ORpmth

  Score

  10^/10

  xwormbootkitdefense_evasiondiscoveryexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables Task Manager via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1