Extracted

• • Target
    checker.exe
  • Size 74KB
  • SHA256 28d26c98e30bf66266f0285e6e94b90021344ce463d319aadabad1ad2d581deb
  • MD5 b92cde65b7ef844370c24caafff01d58
  • SHA1 18dd8d8bf7d373d8972bbb0d6025390c63571666
  • SHA512 385ff0beb1088914fae9c7dfcf03a2174352ed47db597971c45f34019d8e06b13709be8ebbcb8220c100e1738ff80bec57f3b82e2322e6b44bb4b3a90bec6f51
  • SSDEEP 1536:B8l0/4RJCVqy3R7eiCWQubZ5YmBtM4e6XqY2DOcZSUOQHI1:FLZe7NubZ5rnfo/pOQo1
  • TLSH
    T1FF736B587BF94429E0FFAFB00DE53627C779F2136903D61F14D9028A1A23A85CE51AF9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistencerattrojanadwareransomwarespyware

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2