Extracted

• • Target
    d0ab63f0e841c9e27650c44bb6fcfdb27f621e94c4d52600e561e1448d001a72.bin
  • Size 51KB
  • SHA256 d0ab63f0e841c9e27650c44bb6fcfdb27f621e94c4d52600e561e1448d001a72
  • MD5 455cd46c964fd4841977bd2323fff172
  • SHA1 608c99123e52eeb6ff83b0901d5ba0792d0b4b5f
  • SHA512 9457bc37f3e56917ac3989ca45f8fa858ed61aa03380a6554c0200c763083cfd5119b3ff46a86a0e0e633e11961c2e3f13c8cf2a32e4c7572011a8707174dcbb
  • SSDEEP 768:E/MDrGxgTGq7wBMD9vGOHBQ0SSPdwTw7SuHFNg9h78wV6+OAhAYgXDWsPlSzV:EKlTGqLv1O02wdFW9y+6+OApgZ9SzV
  • TLSH
    T1723339493BE54611D5FF6BB96872A2010632BD07AD23EA5E0CC4B59B2F377C049817E7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormrattrojanexecutionpersistenceprivilege_escalation

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2