Extracted

• • Target
    2025-11-06_b956d4ddda4a13e0d6dc3c57ae1d1399_conti
  • Size 130KB
  • SHA256 6b15049422918b6d02726b9507c53ac054938927cb726d2ae30dfc36bad2d3c5
  • MD5 b956d4ddda4a13e0d6dc3c57ae1d1399
  • SHA1 86d95259fd58402a9a0cb982eba032481cad777d
  • SHA512 226a3d25cfacb7542140e12820c2f9fe13b75a2add6cd83a7818c8a7017f2b61268969ac94694372ce6440faf2bec657e5e80e242bf97a8c701a3e4fffdaf033
  • SSDEEP 1536:7MVqqUNuA4U31WQ2DjtjbzVa4BDMS56tQa+x5HaEZSMXe9vV/BXBIJKEtN7NK36v:7QqqvdQ2DRbp/x0CSrgP7NWVc
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  executionxwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2