Extracted

• • Target
    d4cc25de8ed9a89cf86b9ecc219784990236d84df62600d0230a6ef9d40c7a93.bin
  • Size 63KB
  • SHA256 d4cc25de8ed9a89cf86b9ecc219784990236d84df62600d0230a6ef9d40c7a93
  • MD5 c63e3a32c65edb278455d295ac744d04
  • SHA1 67e9ae852b4ff0623f9f3789c87535892e6cce68
  • SHA512 3636b2be87fa99ece13f8eb907fda428f5e33133c732299817be9d5046e5254bf910ec9e446d6f4c642cdeda4af6a88abea90af8e75b8016ba0c9641fa6f65cc
  • SSDEEP 1536:WYMc7OQGCORxDT1n5byfwRYN26IOE0d4v:WYMOXOf31n5byfwrOEbv
  • TLSH
    T1B1536A1CB7F44524E2FE9FB45DB23216CAB9F7235903D61F24C9448A1723A98CE817E5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2