Extracted

• • Target
    Nix.exe
  • Size 22.4MB
  • SHA256 7ee796a8fef94d38a6ef3d906fe3d37052b5b6c2435420dcc75e459fbc501a68
  • MD5 6e66f889923ccb7dc34641a4d7ddc234
  • SHA1 c4785f0696cae4e8630d28e545bbee207544e7e3
  • SHA512 3918b122ae356f0c0371e494a83e128fe4c249b1828e87e2a2650ec929683f7834ddfb9c748cc43b43f06e4aee40574dad9396d0a82f856c050502a8f3c6626e
  • SSDEEP 393216:P9VgKASQW/v5LfypcrHshaoiM7C2Vj6CzKM1THaIas9Jp8SgdcMhm:1VgY9KpTaoikPNvT9zLzgdcMU
  • TLSH
    T16337336624BF9E13F588E17D00AC099E518753DE68D358C29BF847E7CC4B61A2F2E583
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan
  behavioral1behavioral2