Extracted

• • Target
    arzhelper.exe
  • Size 118KB
  • SHA256 1b44f25c4d634420061598ec33ff690f252fd269aebba4d6a77028ec7f4e16e4
  • MD5 9695d38e80f637bbcd0d8cddb94fbd41
  • SHA1 3187c3ea6b623588285a8b46d4be34413a305a51
  • SHA512 5a84dc6de8f8361779b5565b16722dd9ba1ecd7005b4aab80c3c7b37de32b9cd966f8336008e9e000ba6b17a491cdddccd482ac7ab5e6777f6e2a34b02fa0544
  • SSDEEP 3072:4WR8+AGvTkF0bCvPA8iQ6OsD2gn2w2sLm6Ga8lk3vdG:443v4F0bCniQ13gLmAd
  • TLSH
    T1AFC3CF68B7E50525F0FFBFB46CB13212DA35FB235803E64F68D515831627988CE41AEA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2