Extracted

• • Target
    40e154ceb878b9f4fb9a8956e5e069ca2e2c85daca812ee69c3436a56ca80450
  • Size 70KB
  • SHA256 40e154ceb878b9f4fb9a8956e5e069ca2e2c85daca812ee69c3436a56ca80450
  • MD5 0d480b4a6821352f3057347fdba17495
  • SHA1 eeb9bf73a69b472651a16b84e38cff71d553e94a
  • SHA512 808f211b24069e30e670dfbf9992ac3671df6de2f96844e1a2a9ebe91fa45c52d79457054286b248013869293eeb9768e9da01c413abe408d6a2caa614ae4956
  • SSDEEP 1536:6Mua9m3sZPELSsig3tF95b9YPEOdc569QUKVJh7OJecWjnMy:6Q9aYcd1b9acjrVJh7OJeFMy
  • TLSH
    T157636C1877E9042AD4FFAFB058F27122C334FA635907DA1F25D8099B3A37A88CD516E5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2