Extracted

• • Target
    update.exe
  • Size 116KB
  • SHA256 d71070b74c38759e099823804e6d46415f7b4eab2359b9111fc7bcb786cf8436
  • MD5 25971afc41b2881c65894221756cded7
  • SHA1 8a9926997c8b35869087a6a90aead4105957b443
  • SHA512 70ffc7ac8e380c594f2084c1dfe3497e3c29c2557ca05d7775b6cb519edde076a7fbc0695554eac354780fc220b55540621211233dc31185998981a104c6265b
  • SSDEEP 3072:yBoz/x506imJXeKjB1OdFb1ht+qi0AyX81O7xH:y6/P06imQQ10Fbboqi0zx
  • TLSH
    T1FFC3653C6BEAE034F273DEBB9AE47593D99FB7A327059458309213460E33681ED9142D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2