Extracted

• • Target
    0aac658075b7d9e81419d0beaa3db796569bc14fd57512f4479fb36e9cc4c1a2.exe
  • Size 305KB
  • SHA256 0aac658075b7d9e81419d0beaa3db796569bc14fd57512f4479fb36e9cc4c1a2
  • MD5 179e5c88bbd34e45830e7ee3610d5216
  • SHA1 e6fa8fda487392419be240e2911e7c9c346b750c
  • SHA512 04a4337b1303620700aef77f183172c2fc4385968fe82112b3e835d331b7ebd6cb2351ca5768c314b2d7f0eed1838238461e805cb89cf60dfd6034d8d4950025
  • SSDEEP 3072:ZU1tzbXBDsk6iJOmh1U6edqimAaxHoSaxtoR8HFUOBy7U5XsYkjT06G:G1BbZse4U/ACH9ax66HFUFI5XXk
  • TLSH
    T17064E01837E4C929D2FDDB781CA0E1968A35FE651C23561B7AD06BBF2A31354CE013E9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2