Extracted

Extracted

• • Target
    payment.bat
  • Size 306B
  • SHA256 2c7829ad3fdf5698fdf93c8be35d2425e6129d566bbfdff280cd34462021dbd9
  • MD5 289405532bebf12839412a9d288bf231
  • SHA1 d18bf83ee5458f94fb07a6a18113b0754332b511
  • SHA512 f5f8085afad21e9e07df2c3d17b2d9fd3b560df392f201e32acff1caa33e957169529fb1023dc84c25c0d84b7bf74088380c318126783cdbe96f553d65582eac
  • TLSH
    T14DE07252478C152ECFA3D84290F9A2A92A8FB188A20626A203BE9800FC003DAC2495C8
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasionevasionexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • UAC bypass

    defense_evasiontrojan

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2