Extracted

• • Target
    malware
  • Size 82KB
  • SHA256 3e75736535570491a866f4ee1a46e921c55b0dfa9e80354104b5a38623a1fd5d
  • MD5 8b9a675f2ca075adb6ca529016625b3d
  • SHA1 d24358161729fe4059a345cda958466709bbb15d
  • SHA512 bc7039a90866dde976854347b200dbff43979fcbc770303df3f81fb60acdc90c3e194a50020499666a34bf4d6051d67b282391e1cd4e02ab2db6682de569a040
  • SSDEEP 1536:Sqd+ZSwwD+0/P5kDWS4bMeBHYrCxRN66ALj2TCzOgiHWB/A:Sqf+8yR4bMemrYgcoOzHj
  • TLSH
    T19A836C6877EA4515F0BF9FF14EF17152CB39BA632913D65F2881524A0A23988CE407FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormrattrojanexecutionpersistenceprivilege_escalationransomware

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2