Extracted

• • Target
    9fb2c37a42382e80fc99f10f5d8f10d5b19a9d3428ef28ccbc3b617e2afb72f8.bin
  • Size 41KB
  • SHA256 9fb2c37a42382e80fc99f10f5d8f10d5b19a9d3428ef28ccbc3b617e2afb72f8
  • MD5 b76acfa2414168c1a5ad1616963918ab
  • SHA1 95c088cc05f55789cb289abeb50138fa8520e14a
  • SHA512 89c92fbbd9eb005dbd6957c3bffd40d439048c2676904c4f126c1f3bc674cd135d44c3f22cb32fed2df07349fc1ae1592ebd214d669133d0b173cbd46b873ebe
  • SSDEEP 768:wNreDweeLOoHdSgDdebIXvgggALJF5PG9pmJq76vOwhZ3EuzI:w4DweQldSgDIsXvvgSFI9A476vOwLF8
  • TLSH
    T157134B487BE44216D5FF6BF929B362060770F5038913DB5E4CD8869B2B37B808A51BE7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2