Extracted

• • Target
    update.exe
  • Size 7.6MB
  • SHA256 b267e4a0335452c658eba9a72252ac8c9f58dfe93094490f915b18afd86c8bca
  • MD5 81376210e1e232e6fcda071648e3dd2a
  • SHA1 1e52b4486c2b1cc211ebdbfa809e764cd9971881
  • SHA512 bbc077de74cd588d7ee93befae4194c7cd8fd7fa827d156d971bcb2d80dc66cd33ff8fc6b45d139cca0a1eb2a1a610d160efb4bb392257a200fc8bcf07d2ac39
  • SSDEEP 98304:gE6lP+kD9ja5A1h9eT393YigJhH0y3T+q2M51Y7uRlXgVLRuq97fhTnt4glKFqYW:2lPxAA1HeT39Iig7auDXURuAdqPY
  • TLSH
    T1868633A5A2B504F9E8F2953EC2668148F2A3B4579B75D2CF239006166F33BE01D3BF51
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormransomwarerattrojanpersistenceprivilege_escalation

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2