Extracted

• • Target
    x544c7dd3546378c5ce1ebfe873ca95e5c9f1bb6dcb17b0f9f628fb835473a4cb.exe
  • Size 313KB
  • SHA256 544c7dd3546378c5ce1ebfe873ca95e5c9f1bb6dcb17b0f9f628fb835473a4cb
  • MD5 43e3636e47bc3da6a524f36ec498f8d1
  • SHA1 721baf952b7c2b9c40b62d9baf2594725c92be9a
  • SHA512 737e1288e68b6a048a77d920e9d738954e770f3d69c0329a3d0c632ef5adc5bc036bc75731d120870ff28e0f42a4ac19538ff55feb47c855c85c342df9e33bf8
  • SSDEEP 3072:yJahzAAsEu0DNR9MpN2OHv9liz5QFfALNUfBZ62Ouu4MzEPFgpeP1km5uSq9kstl:fzAAI0qHcLNaBZt5IGIvBs3qTc
  • TLSH
    T156648E05F3A508F9F977C63CC9528906EA71BC5647A0E6DF03A04A961F237D09E3EB12
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies security service

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops file in System32 directory

  behavioral1behavioral2