Extracted

• • Target
    1223 (2).rar
  • Size 51KB
  • SHA256 4262a28826c31c7bc925e3b63350345280a328b9eba673c29eca6f2fd8609d86
  • MD5 ad7b15d7bf03265dfa9ef5eeae520181
  • SHA1 92e8581d76e1f6169b1577c5fae8778f0c5c81cf
  • SHA512 cfbbec9194c4c3bc06e2cf3d8e6274a91cf6f9289e292b132a0be4af0e6a70762ac4b3719c7642c57a9bcb7e1741c9a48078e38a38628b2c2accf9121d2af8f6
  • SSDEEP 768:G+/dDPhmzE0Xj9KfD4hejtQaCSRGR2iw7fJC+c1nj5a7p1gD2Iy9R9T29ynbZRd:T/1P4z59KfD5YSRGRj1nj6ja2Iy9fDZf
  • TLSH
    T19133F20FD47D10A8E4592EDF6B6D4C37FE863596809214D338B2A99EBD24FA1B02D770
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2behavioral3