Extracted

• • Target
    4d12606bc56daaf50a315a6583647f216e2e81e38080a06df2c74de0f4bdbafa.bin
  • Size 69KB
  • SHA256 4d12606bc56daaf50a315a6583647f216e2e81e38080a06df2c74de0f4bdbafa
  • MD5 7f0ba654136b411e4d9ff955a31d72db
  • SHA1 b3402c739a6a34b9b9d2c20baec3ca5dbbecf54b
  • SHA512 085db1a2b4c0b9f1122ea59fc2d7c1beca707ecd20f5ab2e5148f9fa20adf9fdeaf3e6aa39c3be3963700cb648249d77e584d2aed54e117848fc8724bba9a376
  • SSDEEP 1536:H1TkcQD380j4bC+PaElyO9bDvTMpcq6ZvJHYOvX3Bfas:H1TXKtX0n9bDmchJ4OvXhas
  • TLSH
    T129638D5CB7E10A25D5FEABF11CF26123C779B7126A13DB6F28C944CA1B17A8CC9006E5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence
  behavioral1behavioral2