Extracted

• • Target
    a0df7e4afcc4845a2c308662028a8fb6bacad97ba3da8b5e23e6a07dd65e8383.bin
  • Size 247KB
  • SHA256 a0df7e4afcc4845a2c308662028a8fb6bacad97ba3da8b5e23e6a07dd65e8383
  • MD5 cfd21b8a0773c71ba047dbd098b5fc9f
  • SHA1 de833d5d58a206850a6b244a59dfa91f6da42209
  • SHA512 61fc0d8c1cfbde5518200a9b3dda124c2cfcf19c9ddd0411b572f7a19c696d08e3fad7bb89a03a9594fd25f017034088a15506dc26787b6151dacf3ff541dc37
  • SSDEEP 6144:4Gpqp6b0V9UhcX7elbKTua9bfF/H9d9n:4OqpV93X3u+
  • TLSH
    T14044BF6C2FA58C06F5FE4E7408F2A368D63C9E732E098507A5583E991B37E885D12377
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2