Extracted

• • Target
    Output.exe
  • Size 8.8MB
  • SHA256 414db85221160da8500c0a4be4abaa4d69f7e16c3a210b4c7d7963bcff6ea068
  • MD5 3f5c44763dbde2fb62aaf4918c66339b
  • SHA1 7256c005bd3e223bce713e92ba3b829033fe7fe2
  • SHA512 6c25fad207458e0dc66fc04527bc8c00e4ed059bf1db8d1996bd7f1156c069d9ec566c15eb3c6f63d7ed0b9f9798c58ae216d4c1a9fa67d2a888e2cd7d8189e9
  • SSDEEP 196608:Cgm5gEUk1C+5CwERPaEcKrpLncZNGC9s0OBFTv6F2J+rP:Cd5gEjdhKrrprmpPOHw28z
  • TLSH
    T1249633A4656CF2D8EFAF067A8820E83BCD558B3D4434DE7E3D3D368C89921F6582B550
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpyinstallerrattrojanpersistenceprivilege_escalation

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2