Extracted

• • Target
    6e296ff19ea6c74104df0a1b9ee59bd64b2ad2b9a7afe31023f75fca691d3631.bin
  • Size 78KB
  • SHA256 6e296ff19ea6c74104df0a1b9ee59bd64b2ad2b9a7afe31023f75fca691d3631
  • MD5 c9f3bc47ee8999abcfee9eeb95b05c01
  • SHA1 f7a169ffeb4b97ad938e752d5cf9353d6d1f8dc0
  • SHA512 f3815ed7f3e01357fd8900865251ac10cc83d6d9bcf557847ed6d3f2b71744158f5ee7aadd4b28deccaa5712f459ad1d47a413c4b281164c30bc93eaca3fb0b8
  • SSDEEP 1536:GP7KCqFheHyyz8coxrvbAekTVGxUbuN9bnWDEhy6aQJfO/RJw:GzKC+heLObALGxUbuNgwnfO/Pw
  • TLSH
    T1ED737C1C7BE50525E1FFAFB51EF57252CA39B7631D03911F24CA028A0A23E89CE916F5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2