Extracted

• • Target

    3848b629a98db7021e3387ffede2ef3d5d9f40234ee1a406c1cb780cf32e230b

  • Size

    14KB

  • MD5

    87e1d3ef8d9da36ebd82fab01d9bf38c

  • SHA1

    65c12c31aad43d6e9385adae4efd2816bf0b2c70

  • SHA256

    3848b629a98db7021e3387ffede2ef3d5d9f40234ee1a406c1cb780cf32e230b

  • SHA512

    17e9b07b7e8feaaec1b3061e155d4d4732fa61c9d9ea226fa37b5acbc81de2841ff292b64d9f6cd48824812121bbec8fa21d7d2ebf58627f604e0a99cee3e0ca

  • SSDEEP

    384:sF7/fSjoqHiFPz0zN9wJ93r6DTiAJzfknTr:sFtyipzO+rRKknv

  Score

  10^/10

  defense_evasiondiscoveryxwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1behavioral2