Extracted

• • Target
    c4cefa952708b380283b5d0ea62154bb211933f523532d4f3d14f309c63b88aa.bin
  • Size 226KB
  • SHA256 c4cefa952708b380283b5d0ea62154bb211933f523532d4f3d14f309c63b88aa
  • MD5 638124d5c7455c1eed26c00028414d4d
  • SHA1 79ca2118d2ac2f91de0ad804090537fab7b19ad3
  • SHA512 7191a67b4d741d249ff7026e99385ccae6c1b2890da2b4f0d6b3cde1865064f99be433301896a065fa3e34730f220aa4366e8dcce4cba96bfa6268dea45f0090
  • SSDEEP 3072:Zyn0b9StR1lb5MSFjFvFOOxaF8SKfbzxcwg7es6/Vsb8VKTu549oJMfF/H9N3KyN:ZynHdb5hoUhcX7elbKTua9bfF/H9d9n
  • TLSH
    T1D634CF5C2F658C52E5ED4DB408B3A368D27C9D732D0D8603D69C7EA51B36E886E123B3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2