Extracted

• • Target
    x2d3663f6ef990a6b0a9646cb00f401c76e84e16cf38d8c167b265290f0ad6cd6.exe
  • Size 2.1MB
  • SHA256 2d3663f6ef990a6b0a9646cb00f401c76e84e16cf38d8c167b265290f0ad6cd6
  • MD5 65607519ec605c8801bdfb804adbe11b
  • SHA1 90a7d214ea6bb0713f7253edc8e77aa28512e649
  • SHA512 e21e6e207142c18dda286234604ecc4b7c4ac4afb62aa592398d2383c333a2e73c628d3387f25d759488301a9423f558d57dc74610c411c4b923ae0d70f14267
  • SSDEEP 24576:7pcAPryslR0DsP6Ce6PeAVDKUTbQIzFLwL:7pLeote6P1VmgbQIz
  • TLSH
    T140A5F513EBD25ADCE2AA49329F945450DB2EF22667EF62253019024DCE47783FF50A3D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2