Extracted

• • Target
    WindowsOptimum_installer.exe
  • Size 39KB
  • SHA256 e6a01d1af2c068fa403578ca3ea4c57b2748717d6daada3f9cc561cede2c1155
  • MD5 0dd0feb1de4ecdda98d864ffa2a222ce
  • SHA1 33343f7f570cdabe0fffbfcb5e15483303dc48c1
  • SHA512 39efc8d362f9fa2e51f9fb714707f5d590900df874564ca2b8271a79632ed552f66c2719b9681536f5c28bb8194015a73eb37bbc07b7c98bfbfc69b967a282a5
  • SSDEEP 768:/U0LIQRRYM/QjHFKuu3amxHpufFWPr90xE8e6POwhfaQAL:BL3fF/GHFKuu3am5EFS90xE8e6POw10
  • TLSH
    T1C3035C48BBD08221D9ED7FF569B3564B4B31F6039A13D74E0CE4829A1B676D4CE803E6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2