Extracted

• • Target
    e3e6db03f754aa7f220094410d1029c93a99cb859c89e99e94ffc35668e9f44b.bin
  • Size 41KB
  • SHA256 e3e6db03f754aa7f220094410d1029c93a99cb859c89e99e94ffc35668e9f44b
  • MD5 51a9e6a5a086bdb117075c60ade711f0
  • SHA1 1f375539f7ae67d06cd49c1e438205b9f5fe507f
  • SHA512 20cf351ab749f3a714d6df3fa39ffdb6b298e54c85d830b514baf24fccf4c3a167b0125d09fd8b44733f3e44232aeb1b5f2bd42f435835ce6e91cedde57b62f4
  • SSDEEP 768:ZUDlQj1Zx5qNjk8womL1ZlJF5Pr9p5zPD6iOwhx3/Sd:ZU6ZxEtvB8LFp9TzPD6iOwD6
  • TLSH
    T1F5133A057B918625E5FE6BB519B266070731E6038E23D75E0CE892DB2B6BBC0CE407D7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2