Extracted

• • Target
    281d9638fc314c96bf2db3b3b016dd460bda0623541c85db31d4645684fcf562.bin
  • Size 135KB
  • SHA256 281d9638fc314c96bf2db3b3b016dd460bda0623541c85db31d4645684fcf562
  • MD5 471d7668d1547d744fb1fd34f4c35d19
  • SHA1 f50ac0357a339735046357948739f64af63b61d8
  • SHA512 cb0bc9ebd5a8e75bffc81e2c74bd30e9b5dead03fde5a5a91b12eb856a34ef1d10059999d9177d2e8919c4b0fdb7e77f324bd27967276ce8a2d25a3df7077a46
  • SSDEEP 3072:omNS1taljcZApKAAqwiLvW+19azMD6ZHHA8xcRh:DNDlTIAAqwwWwagWZnCR
  • TLSH
    T1CAD3F2DCFB758110C3481B7A0BA9126523BD7B83A2027DF99EC0DADCE9E41D5C427636
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2