Extracted

• • Target
    e162e61f3e91885bda9d2ed998f5743ab6d40e8c2392408f6b9344f74054050c.bin
  • Size 40KB
  • SHA256 e162e61f3e91885bda9d2ed998f5743ab6d40e8c2392408f6b9344f74054050c
  • MD5 280bbe5bab51f8c20dc957e83c7818c3
  • SHA1 65a2bd3fd918d164816e04ade5b7386b02824ea9
  • SHA512 52f8bb564edad2581a7548fc86894402fc468a6b975f4a07264ca454e2026d7f8d0d11caf008c72fa14892ae88751ca0e29d8fba262df66c050e09265c14c259
  • SSDEEP 768:6NZ4ZV7QMND9PvVPnDPItE9/JF5Py9OvXN6SOMhm33iN:Uy7Qo19PnDP5xFs9CXN6SOMkI
  • TLSH
    T1B8033C047B944625C5FEBFF91AB3A6420630F5078D13E79E0DD8CA972B27B848A507E6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2