Extracted

• • Target
    d8d1278cb33f4969fb58a26d4372150cfe117ca78b77afcb40fa952e974ce49f.bin
  • Size 41KB
  • SHA256 d8d1278cb33f4969fb58a26d4372150cfe117ca78b77afcb40fa952e974ce49f
  • MD5 523c9206ca2f8b253cc2ae885a15ee55
  • SHA1 2c7ee93c11a15a023e03c6cdcfc9b57af69aeb4e
  • SHA512 ec86bf4df8d47ccd9eacc0877f045fb361d1552dbcc1c1707b86e6babeb4282505fca68eabf40134ebb05b1c7498fb65b259c13a9dd1e6eab49f36db1ea9789e
  • SSDEEP 768:jhvGkOK5lJMU1BaeECAr43MZfJF5Pa9p+4l6iOwhl3/ubm:jZzZ5lR147RrtRF49I4l6iOwHmC
  • TLSH
    T180133A457BE50226D5FF6BF919B362060A71F6038D23D79E48D89A9B1F37B808A007D7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormrattrojanexecutionpersistenceprivilege_escalation

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2