Extracted

• • Target
    PackList.exe
  • Size 40KB
  • SHA256 1b8a48b384479b77957ecc10df574fa9bc59719330bcfe5cdeb493603149d990
  • MD5 bf9c727fe7f40b1fb064f5cb512aa970
  • SHA1 0795d3bb8603ee7201adfee7b7249ab30dd5f9cc
  • SHA512 f0def2a470dcc355a7ae282d56ef8948e227fb9378f187a5aa960ba11099ba7f1e70edb1c147d6d2e9cb719882d2343e75977487d87e3e46cb1997bf96cdbca6
  • SSDEEP 768:arXJDT0yg0xvn5tUvOFWPI9if6cOMhKa5b:arXJ/0hM/NFV9if6cOMI4b
  • TLSH
    T1C6034C483BD54211C5FE6FF959B3B2060A31F6039913DB8E4CD5999B2F37B848A053E6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2