General
- Target unsecapp.exe
- Size 421KB
- Sample260425-tp5jhsfx2l
- SHA256 cf30a9c2841bb1b06d73ff92ef28bccc7e5441fe8c7c1b877357105ff4851e35
Score
10/10
Malware Config
Targets
-
- Target unsecapp.exe
- Size 421KB
- SHA256 cf30a9c2841bb1b06d73ff92ef28bccc7e5441fe8c7c1b877357105ff4851e35
Score10/10Detect Xworm Payload
Family: Xworm
Xworm is a remote access trojan written in C#.
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Executes dropped EXE
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.