Extracted

• • Target
    WIndowsXLite_installer.exe
  • Size 58KB
  • SHA256 767c13474637dbabc2a0d434989e92f037c85c883ce394a095c498130d6f79e4
  • MD5 e0334788c518e8ace0f9e63e99d7c495
  • SHA1 5e40e077f792c8fd4c14a64b545bb4885cb15b74
  • SHA512 f9102e396e5731006a22f50fff6822eb11566f083f5ee9c804508d27046e7a8454747c83b03274c64d2656e8a9c981d769ec4eee492ac85428bb62ff0d77d38c
  • SSDEEP 768:wq7IMhBA/S/EO50guqZR8s7FWPr9EFOwhLaDHk677sa/UxW:r/Myz50gdFS9EFOwJWHkksaKW
  • TLSH
    T144435B84BB80C365D5EE2AB54AA396F30370EE364A13FBED48D47295EB563C4CE41385
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2