Extracted

• • Target
    b20dec1dd43274d5ec9913caf6464463e959946b5962070404f47a2248cd8b4e.bin
  • Size 37KB
  • SHA256 b20dec1dd43274d5ec9913caf6464463e959946b5962070404f47a2248cd8b4e
  • MD5 83f90d0cc39da1cca5c7a08d82fb3a5a
  • SHA1 6d1de627879b4b8b21b0c7d4e7d0e338c015f9e3
  • SHA512 1340f29171c011fc37275e6a57581ea90d8b43ea43662375d3682840a37647ebd5d6deda399258bfbf496c51fef4b4ecd17625bd416f7b9f81cfe450ee91147c
  • SSDEEP 768:7pJy/lL9OVAx23cCIb6zU2EHCv9Thqri+V:tc/lLRU3ib6z2Cv9Txy
  • TLSH
    T1EF03194D37A08B15D6ED9FF459F2E2520675F5078E23DB4E48D848AA3B23AC08E157E3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2