Extracted

• • Target
    71bcba6c7b6d3495e55b10aff6a06007f5c718da0ea67feb03794b5d7ddf5c48.bin
  • Size 37KB
  • SHA256 71bcba6c7b6d3495e55b10aff6a06007f5c718da0ea67feb03794b5d7ddf5c48
  • MD5 3d6398f9a79d62c66a3f9560ee9fc714
  • SHA1 aac555c110878f61bfccc58053693af523b0d330
  • SHA512 e6722f61e1a040fe4ac80b09d906fbbd1de76a241b2f5d382e264cd591b2cd5d7a14842d01ee160e4921bc242cd97fddc50741e097cfbb34f483d9dcdb83a61a
  • SSDEEP 384:0jSXe516/6aDUSEoSLF63LZOTuPH2Cq9WGeKZWFEw5DpkFyHBLTp9iZwdJzVvNbG:U1SU49PkQGeKQ/cFyz96+6pOjhEyA
  • TLSH
    T1E1035D08B7A44726C5FEAFB45AB265494630F717D917EB9E0CE584CF2727AC0CE10392
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2