Extracted

• • Target
    ac8cb421994a8cea14581f7c45e6c41fc84c3ea3f919f0eff649baaf976b4de5.bin
  • Size 36KB
  • SHA256 ac8cb421994a8cea14581f7c45e6c41fc84c3ea3f919f0eff649baaf976b4de5
  • MD5 d01f935d6378ed95ab4443156cb1a9da
  • SHA1 3bed20a7ebd71474c61a43b2e4d3a0abc7eec36a
  • SHA512 719315eb7d7e0a85073be2d1f03fe35282536f56b008b29fb42305f54830ab0c454ef9650c9564911e24b1da379baa3c5330cfa8770241a38a91ef78ace16f6d
  • SSDEEP 768:9TlBb44p049zfflPRX6T6y+xyW5Fyw9/O6KO/hXyn:9JBiwxRWsyAFr9/O6KO/Vi
  • TLSH
    T171F24B4877904321D6FDAFF46AB3B2020578B607A917EB5E0CD8899A6F33BC549113E7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  behavioral1behavioral2