Extracted

• • Target
    ee24e1eea98f12e3e5cb88436f6fd0d99f8fe40c8a90ce62f55a14fa862f0103.bin
  • Size 458KB
  • SHA256 ee24e1eea98f12e3e5cb88436f6fd0d99f8fe40c8a90ce62f55a14fa862f0103
  • MD5 67837cc9d570c7bd92cb7a9f492228ef
  • SHA1 b11e50d49c14eafca6faafe8ed3c2c8541256551
  • SHA512 6d7720a44d0c42b31c165dbc70358f6a61c0235f8b8175b5425eb1e1fcb4a89fd9f4f44cb66352a40cc832f45a8b85d3028db2156e240df24429df97876d363f
  • SSDEEP 3072:V8bubT08A/IjF39jSOjfUufJ32u11525XVZewJ6VCz2gE:V8bubH397rrwfJ6VCz2g
  • TLSH
    T199A428B023206D0FD05D9D3E5B98F71229B52BCDAA875941C6B286DB30BB4A79FD1CD0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  behavioral1behavioral2