Extracted

• • Target
    70ff2b1b5c9bee8a995be07cc3a372b6707839d8e8b655feb786b6852a12b7ad.bin
  • Size 69KB
  • SHA256 70ff2b1b5c9bee8a995be07cc3a372b6707839d8e8b655feb786b6852a12b7ad
  • MD5 b445e97e80985fdb435ef12ee72d2bde
  • SHA1 98c44846f8c5bada6a3ef4f72d35d295f35411da
  • SHA512 8e8db2229205ee97dcff62274d52f2bb230de5d905dc7f61d42d137a8c70ff3ab067d8c2f1977f1b91d63abeb3b05202d21d44ed7c89917933407bcef14180ee
  • SSDEEP 1536:P+JsKqP5MHXtPEjmIQJqCWBxbPQGwPgM546WSOd0w8y:PysKpPaMWBxb4GeOd0fy
  • TLSH
    T152637C1CB7F54425E4FF9FB898B27216CA75EB238D03D20F28D6019A2727A89CD417E5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2