Extracted

• • Target
    ed18463ee2b257d617013a7abc35e41aad0c198d59887409186260f117af276c.bin
  • Size 45KB
  • SHA256 ed18463ee2b257d617013a7abc35e41aad0c198d59887409186260f117af276c
  • MD5 efb8684b37ad6aace2aa16e5cca56707
  • SHA1 a5e0bcae4c2cdd2a38f5d057a8aca75bcd6cea33
  • SHA512 97f9d7ff205e49135fa4c328b750cbc004b4fa78c4aa9a8c6eb5d12bb5fc01b23c7a21d89983f836d84ace509ea11fccdefd535d49be23224fd76f9997c6dbf2
  • SSDEEP 768:qBUpkvJC9xTfBt/uAlTcMcMtlYztQiVZlWwbFEPr9pKT6iOChCzj2g+:qBvCrHmiIpwlYzFGGFM9oT6iOCMX+
  • TLSH
    T146235B087BD08621E6FEABB51872B6060671E6179D13E75E08E483DA1F277C1CE907E7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2