Extracted

• • Target
    Loader_Prem_Slayed-cleaned.exe
  • Size 462KB
  • SHA256 175a7e9453deed31e1c98273bfc3c44128ec2a550568f328069658cb4ff7dd04
  • MD5 6faf96bede8ffd1a9c28f364d9c9d341
  • SHA1 f2421c884aad87a7403de24afaa7e3d7f9e67d86
  • SHA512 33ad986876cee3391fb3be75a088073cbaaa19f57632840dea1798e9c0f8c9e2bd30e70a4807c6c4ca5d5e175c46002a7600342d87b9ae5113ff24beb1b37d17
  • SSDEEP 3072:9CXmav7HbIaOw/pZl2Wz2IRss/PK2Nn53:9CXJv7HbVptHFNn
  • TLSH
    T195A494E3D2940668ED986B7952339C5F51BBBEB97EB0B44DA11EF4B25F332C20025907
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2