Extracted

• • Target
    VoidlessServerSideV2.exe
  • Size 89.8MB
  • SHA256 58695e9da124479db38a849187de2599db7dd394b65449b586713211f58faccb
  • MD5 be1b051b10e4f013330cc498f5fa61e2
  • SHA1 15c7b0307273d4c9e842affdeca0a1fc2df0a4dd
  • SHA512 053910bb1c99e26b4a6df95620adb00fae97ddaa56de5d3f6d21a6088754644a26562da383a88c1923f286f5088cbbe95e1b7f2af50fd4c4a8e2f03e583591b0
  • SSDEEP 1572864:jlgHth7pOXqorAXbXrbo/gA+/RkKc/GU938jEGsoNNodXhLW1YmxMB5:jWH/aqorM7mgA2OP/GUV8jeoNNoVhFmk
  • TLSH
    T1A42833013CD8E971FC2459364E5DC5588B33D92B8378DDE76A34AE897AE01C192F8E72
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2