Extracted

• • Target

    BootstrapperNew.exe

  • Size

    2.5MB

  • MD5

    4d98901d7d0d7f62de6e076d955f1926

  • SHA1

    e5a6e473f8b089171b7e79049c6d0ca6c5fb0ba3

  • SHA256

    dc5f812fd7931f68b7c178ee741a9f39f53d7a50df2b7db3a04027079e2d3cb9

  • SHA512

    c6795843377fdd44a5cee28a918788f6e6bc67b195d3018ee95313bc82bf96a787e934e56923bba5d5a22d7b42691a48f1ee858817773db44d28e456977b15f4

  • SSDEEP

    49152:YZPjorfOAfRxx13BIq8IYpSqxN7XGQKoBaJ3RIrMQJZipKE1:YZkzD73i7pSqxNV5wQJwd1

  Score

  10^/10

  xwormbootkitdefense_evasiondiscoveryexecutionpersistencerattrojanupx

  • Detect Xworm Payload

  • UAC bypass

    defense_evasiontrojan

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2