Extracted

• • Target
    RenameThis.exe
  • Size 162KB
  • SHA256 bd7137c16c8c6c24e1bb91e9bc4cb6d03a7bff7bc52b7d334936af652829df67
  • MD5 71535816b36c01751fa3875f602d848c
  • SHA1 fbacfc414c6b6faa20af774d44b3d6a834510338
  • SHA512 477c799b55d5d920437eb99f135d44af40cfcc00a221408fe67c8a9b791787c048064abece85036e82a2e4e2285940748a1e15c20e5f6c6e3b9138979d747a82
  • SSDEEP 3072:bN4CXhKMCM3OHeLbqVSovyfnE2Qt+DUfFtTiCIvViw2zhU:J4kQAOHevoYpQt+qt2CIUwM
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xwormbootkitdefense_evasionevasionexecutionpersistenceprivilege_escalationratspywarestealertrojan

  • Detect Xworm Payload

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables Task Manager via registry modification

    defense_evasion

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2