Extracted

• • Target
    697f525d8b0acb005b3497626b7c25b2fa58ec6b93b211b23198564652e42e02.bin
  • Size 41KB
  • SHA256 697f525d8b0acb005b3497626b7c25b2fa58ec6b93b211b23198564652e42e02
  • MD5 0bca500c2145fd41472a9e57cde316c1
  • SHA1 686d83a54c66d847b2c368a514f32c4e891ab86d
  • SHA512 c4a8b003b27bd703ec03b9af19dd6031c687c828e2951a975a2d3abc7791cd3bc3238f0356d6bdca4a97ff57327bbc96c5f51ad4f5feca11d04b2458b67dff6e
  • SSDEEP 768:p4nx4z6FPXphqxdk8womL1koJF5Pr9p5PY6iOwhJ3/Su:pAS6Pp8nvBJUFp9Tg6iOwXt
  • TLSH
    T10B133A057BA58625E5FEABB419B256070731E7038D23E75E08E892DB2B67BC0CE407D7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2