Extracted

Extracted

• • Target

    BootstrapperNew.exe

  • Size

    2.9MB

  • MD5

    afc3d1344bdaf253fbfa774c1bbace0a

  • SHA1

    adf47d0df0c94564c559da98500e7e19165a9cea

  • SHA256

    a84273c5deb772a3c6d1e32e2c017136d734f82c160c6554eb0d7fed8203eb0c

  • SHA512

    623839618cbb3f06b06b920bee1908a005cba8432b1c04170397a7ab959fd038c8221c82d3e972dfaacaf791ddcb9384fc49a95d8f52fa90f4f778ba188d2064

  • SSDEEP

    49152:kVvs4yZZB2bs5dbMZfaFs+mVZgAnu6aTlFCtx3RH4leIu/UGTB0KZR6KTPCdB:kVvs4yZX2bs5dbMirIZgAnKTlFEwAvzy

  Score

  10^/10

  xwormdefense_evasiondiscoveryexecutionrattrojanpersistence

  • Detect Xworm Payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2