Extracted

• • Target
    darkstream1.exe.bin.exe
  • Size 8.1MB
  • SHA256 d22517dafccc940c38f7fc6004d215d9fa9a7a1da8f0c7f2b552be3bcfb94767
  • MD5 2532c2706cd5a3331b8f76271316a0f0
  • SHA1 80cfd908302df1357a8f53f36e99e58f21f62afd
  • SHA512 9f5dde8e976482e5430c70d30822d7c8d0d41f0fe186c21f9897215a79de505416b04def86829e53ce9b7a2f4851e0c856b76e068002eea72a36d438eff1fc89
  • SSDEEP 196608:NxN/Il5wdeJpLA+TloYNssD7N3ElDWOnE/itky:oWkSaVJ3SDWO
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xwormexecutionrattrojanupxdiscovery

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2