Extracted

Extracted

• • Target
    b9d7260432ab1425de3f4735222bee7674192581531c8aad987acef1779db823.bin
  • Size 84.5MB
  • SHA256 b9d7260432ab1425de3f4735222bee7674192581531c8aad987acef1779db823
  • MD5 23a20f52f550cc7beed7c45459b08c35
  • SHA1 64273550b815ede25979f841d7871d3dbd4dc06e
  • SHA512 1475b554823fe9d324427b711a72ab0373b148ff4661e46a57fee4b0bee7f405c2dd70d23339c79927d39dcf59f246621d4e249895fdf061bf711a310e8e686c
  • SSDEEP 1572864:Dxr0C3qckTTPlLVMjuFF+/bzDamBTXr8i/Yahi+BMKoosR7pSqQ5Pc28VcJPa:Dx98jGun+/byibl/YCi+BMToslgq68Vk
  • TLSH
    T1791833608249CB10E384DB32BCE1A3C3D156E7F7CAA977B938574B9BD94BE088D60D45
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxbinderxwormloaderpersistencerattrojan

  • Detect Xworm Payload

  • Family: XBinder

    XBinder is a crypter and loader delivering a wide variety of malware, written in C#.

    loaderxbinder

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2