Extracted

• • Target
    1442.exe
  • Size 28KB
  • SHA256 c7ca8ab7360335abfd24c031a3e6eca9f2241e650ffad3caae0e361a5769714c
  • MD5 070d580cc3ee8bd7bba0268f953cff9a
  • SHA1 37db0f82dd66114275757526d3f54400e658dd16
  • SHA512 39c23e9b226b8073a98dcb1b5ac07f45f053a3835db03295b42489e914792d49b448a5e0c10340061d7d1a21aa5bc4a12af7a8dbbf554233e0e758ba6d747932
  • SSDEEP 384:71BLpDUYN2Z0u4ocfQYcQzVEI2yKYymNru/ttQ9a9stDLq2OUOOu3LTShQ:npIYN2jcfQjyKtkru/LQIM6hUDhQ
  • TLSH
    T127D2BE2552C54236DBAE0F365C63B39147B2F316ED7B8F7F18D4E12AEEA32488522131
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxwormpersistenceransomwarerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Disables Task Manager via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies WinLogon

    persistence

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2behavioral3