Extracted

• • Target
    4569fbc02dd2086d0c9320ff8043c717b1cb08c0ed42da3ec9ce8e97a0e0f9c7.bin
  • Size 173KB
  • SHA256 4569fbc02dd2086d0c9320ff8043c717b1cb08c0ed42da3ec9ce8e97a0e0f9c7
  • MD5 b1b2164d3b129e866ba3e2afb5e43046
  • SHA1 d1a3f5bde84636cd35c7684dc2cde4c04ba93b9e
  • SHA512 a235147ff5f3dc8a9090e317142cf179c1a2667dbdca96a9496d387cf88e404b44f560dd08ad7c7223b73a184aeb0283ad2d9268fc55d82cd1eccf54b9432b42
  • SSDEEP 1536:7OvL1E3MKnEJckGkK0V+bUKGaPt66KOmn8zt0SycUJEz:iS3MKiGkK0V+bUOMO1zt1OEz
  • TLSH
    T13204C0CB2E9506B7D3ADFA7058B3733D472BA93E2BC39E1E948B3D49173294C8940165
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2