Extracted

• • Target
    91d34ac4bca84cca3b72d7b8aa9d76181640c4eed514d38e152a6a4b4a6a04e8.bin
  • Size 55KB
  • SHA256 91d34ac4bca84cca3b72d7b8aa9d76181640c4eed514d38e152a6a4b4a6a04e8
  • MD5 a49461157d21382498b8614b5d738287
  • SHA1 1de5b7ac0baa3ef8057b41cc47fc378c39cf797e
  • SHA512 b58748eafd8bcbb971c1483f8fa2a092b78a8a8b7ee36cf092af5f6012142cd88cb60709293e4103b9a3f4966b634704ec6c4cee0a6603a744ac78fc237ab4af
  • SSDEEP 768:K+pfdJtLEecMPbqZYxdB/fTknkUjV910pf6BGbHe6WD6GZuSO2BThyagzW:RLnfOCxfInJjYffbHe56kOWTqW
  • TLSH
    T104437E187BE5411AD0FF5FB01DF65266C63AA2A359139B6F38CC01EE2A13EC9C9407E5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2