Extracted

• • Target

    PO81025.exe

  • Size

    551KB

  • MD5

    5ed7cd000af88d1d45ab776014efc310

  • SHA1

    90aafc2ab9d80ee249ec8ce2482156c2964e1231

  • SHA256

    86ffe66472be6ff6bd7931001bf0bfcb5f88bd76bac7c5ae1b366c2d6234088f

  • SHA512

    74a7ee091fd3d5e9ade00011874b8c7f216b06845925a174b44dc399ca8f435939c1607ea7ed75cc4329a8a0023a0fb5423dde05739bc78b19109c23a3dc95fd

  • SSDEEP

    12288:0/Yp50g7ZeK50g72OVVyEqJUhkPbwoxC0WLU/1RQIXp0W:Jp5F7AK5F7PV8jJUhoC0WIdRZ

  Score

  10^/10

  xwormdiscoveryexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2