Extracted

• • Target
    c28e01595c33f6347f51703c4231763b6e66a7398c9047c9990579bb9c1fa10c.bin
  • Size 196KB
  • SHA256 c28e01595c33f6347f51703c4231763b6e66a7398c9047c9990579bb9c1fa10c
  • MD5 8ed5cf2a20465c1cc5d2093d5e526583
  • SHA1 710a3f26d445a54ad98eae9228cca417c0cead4f
  • SHA512 af4283f824a252373dcfa28a8be547a8489137205a8437e7fe711b29d668e9bc5c61a93a62fcf756476e8149bdad90931a5a779df189ef9f4a8117d1cdb047db
  • SSDEEP 3072:QaYK/xvY3BO6mil9sbe2TMEtOFc6dEEetYmS4g+Ehfx:QaYKpv+B1jlSb9MEkIEeW4g+Ehf
  • TLSH
    T1EC142C9E2E4506F7E36CF93480F3332D633EDE3A3E965E0EE8AE3E9566318485944511
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2