Extracted

• • Target
    system32.exe
  • Size 80KB
  • SHA256 a8805322a61b72c280fd1719c766f53d47343de8c480daebf8340a669fcf2fb7
  • MD5 4487cf1ef882d82d2afe88c3bfcefc11
  • SHA1 12b82086c7bb487bad7d1577efcca531af048be0
  • SHA512 ab28ba8226ca7552ba54f36e3b29ace1ca7a3bfe122db7c21fa3e677541a03fc76cde3d3a4ef576e4b07fe3cc8693f7174d055f65956d903726b83c3e76a31b0
  • SSDEEP 1536:HO2VD7Ix3FyBQYNsiJ0CZHWpCwh9c4Lj6sOYrJ:dVDs3QB3qiJ0CWky9c4ZOYrJ
  • TLSH
    T109834904B7E44614E9FF6B7548F2624A8F32F5072813DA8E08D646ED1B67BD0CE427A7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2