Extracted

• • Target
    7c9fcde28b5b27e46e85760823d49105291d2a161a58a9106099c595bd4c6f32.bin
  • Size 44.9MB
  • SHA256 7c9fcde28b5b27e46e85760823d49105291d2a161a58a9106099c595bd4c6f32
  • MD5 c20a9c335bade9a45dae0f02f8af6e7f
  • SHA1 71167968c4386def4fb7bab478321a1bb3a147b5
  • SHA512 b431e2e99674c345438f71c98d8b70d6eadc60851b0fae2099016419e2aca2d4a202ea897a6fadba9ff1fd3f8097207149aaad6ddebcfd2a73bd0bd4a1624bb6
  • SSDEEP 786432:QeJ97gO4msShTTifRYsaNQ6NOzfWCN8G0A0SjM+o7/95:QG97VKSh+RjnfWCNv08jMV7/9
  • TLSH
    T1BEA7E0A62854CD0635E82FC3B2592DB9DF6C68EE5EAB097C490079C3347237A2394DD7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2