Extracted

• • Target
    d181856c7c7af8f09c799900be4fde66bc44eadf2f25fb78e5bacc82a32515ae.bin
  • Size 255KB
  • SHA256 d181856c7c7af8f09c799900be4fde66bc44eadf2f25fb78e5bacc82a32515ae
  • MD5 64c3d7f7e03f56d082f80ee6b025ad7c
  • SHA1 702b5867ed4119e462e809579930e7cf566180ce
  • SHA512 3563eceb08b6213c2c45d4c8a6a72d0f731ec481acdadadeb858798165074e844708eea09a33763966b65a1079c8b1a71e01c68454f00620059d582d322996a4
  • SSDEEP 6144:UnuKIG9/buN42iTVVmVVV8VVNVVVcVVVxVVVPVVlVVVRVVVtVVWV60jVLVVOVVUa:6fIG4N6
  • TLSH
    T103449781CF89148BDC3A9F31E1B0B7654B7BEAD0B89A9F6D206D3D2D7C54A409C02779
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2