Extracted

• • Target
    https://github.com/Cryakl/Ultimate-RAT-Collection/tree/main/XWorm/Mods/XWorm%20Enhanced%20V6.5.1

  Score

  10^/10

  defense_evasiondiscoveryexecutionxwormpersistenceransomwarerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Modifies WinLogon for persistence

    persistence

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Looks for VMWare Tools registry key

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1