Extracted

• • Target

    Sukioshe.API.bat

  • Size

    102KB

  • MD5

    378a551aa3a4c5e0adec167eaa224b24

  • SHA1

    0f55fd5a8bae0149321975f44599314ca96d954d

  • SHA256

    0b6f399b1b5e976944d903b553343fa00c0af1dacecfcb161b7018c3282c8c8d

  • SHA512

    a291af2e59ac3db474a6139b6ce2d672d6c556a61bc7ec0360e32565d93c5a1d8c71b7306826232fb78749b6b0a72787763b7ca94e2cda38b0afbcb9ab0e890e

  • SSDEEP

    1536:y1YNBiAGQ4g3JGPFSutTsn5zr73oWiA6WwprhyIha1CjRAoH28oKN34rmeeS3BQe:Hf0Qn3CFSutIHwp9yJCj+oWC45eWKe

  Score

  10^/10

  xwormdefense_evasionexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Deobfuscate/Decode Files or Information

    Payload decoded via CertUtil.

    defense_evasion
  behavioral1behavioral2