Extracted

• • Target
    09199752288db21f4533f4927f45c4b1332a9042a0c86f8806d51e8fa9464f60.bin
  • Size 85.1MB
  • SHA256 09199752288db21f4533f4927f45c4b1332a9042a0c86f8806d51e8fa9464f60
  • MD5 9a08c8cf82f715a720bb671f8bdd9477
  • SHA1 ed3d28692257dfd81ef4cd50aff3881b20812b1d
  • SHA512 5350303ebf92f43006c97d1d96231707ed9d7ff168379066483609d922e613c1509ac2b3dfb61c6e66d0df05890629deefb416bb8f4d824b28461537109ade62
  • SSDEEP 1572864:pzZmILMEWtXRBitEVa9reFf8lkk9xVlYwBKE/MIJoqMyOrrfCmQPruUQAcp/w:pzHyGEa9eFfnCXFBKiMIJoFyOX6myMAF
  • TLSH
    T11E1833505308C684F3A1DF35B8E0A3C2D036AFB799AA37253D677E5FD837A098D20965
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2