Extracted

Extracted

• • Target

    VelocitySupportTool (1).exe

  • Size

    250KB

  • MD5

    1904b43012a89c4ec5b3c82c7f7e313e

  • SHA1

    3b0eedb1ba0bff205b9d099dd355091229007d04

  • SHA256

    1446224da9810c06e7336730dab3811c39c8d1d4b200c4e7d568b1440b432f61

  • SHA512

    c37e6bba9776516201c28367dcb541ac108a1def13d72eaf311800710c854a794835b7b92075e3b5d61ff3c500e1446004479065e418e3cb0dfb41963123a06e

  • SSDEEP

    3072:0AgVT/y+i3B0ELNv4TW+gLdLY/rxlfP3JIxlR6d0HoG1Bz65/M6If+3Js+3JFkKf:MT/cCTOLoP3JClR6CIG1xBt25

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1