Extracted

• • Target
    7ac63392f7b17aaf1bbcd52e0c32af58074b9ae9ac994b812195ca7bfb1462ad.bin
  • Size 35KB
  • SHA256 7ac63392f7b17aaf1bbcd52e0c32af58074b9ae9ac994b812195ca7bfb1462ad
  • MD5 c2fe4b7016b15f4e8632767e6b728ed3
  • SHA1 3eba0134b953dc2b2d916898a5190797de47314e
  • SHA512 b78c4ef15ceeed7b3f18beeba8ceefc21ea904ad4d157296a6fd39b952d585a7888d7b3279ff4c2f969832a43240648e643097cb5abbb82c9594497fb03bfaac
  • SSDEEP 768:Fx2V4v95ovQ3wNasfuH3b5xF19/M6KO/hX/rJ:ec95ovQg7f6jF19/M6KO/1DJ
  • TLSH
    T1BFF23B48BBD04612CAEEAFF559B361460634A617C923EB5F0CD885DA2F37BC08D117E6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2