Extracted

• • Target
    binaryx.exe
  • Size 4.8MB
  • SHA256 f456489383ec1bf7af5a3ba7014957d6ac5f3bf37272bf49c91322a96be40013
  • MD5 a1ef34b7f1056513e9904734ef629a99
  • SHA1 1903cad5fae8ded30c867a4d562c7fa5a64a9c81
  • SHA512 cc1472fe7b72f997ea4a44ad5362e0bc36a16b711627be86076cbe54c35b62a83d4bce1ecb28536b9c13dff7ab235806a319cb3d57a2f5dc000a76d1063af9bd
  • SSDEEP 98304:r0000000000000YTtxkNTc3/eV4dADI3kqXf0Fgq:6N2Y4eSkSIg
  • TLSH
    T14C368CD4279A1BC3C6923FB8193E3258F934D2F50AE882E9947B0DCA057E5610F9B7D1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies security service

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Modifies Security services

    Modifies the startup behavior of a security service.

    defense_evasion

  • Drops file in System32 directory

  behavioral1behavioral2