Extracted

• • Target
    e058ddb3433a80dcdad4b6e9ec339d6ceb67fc13e7faea27bff82727fe1398ec.bin
  • Size 41KB
  • SHA256 e058ddb3433a80dcdad4b6e9ec339d6ceb67fc13e7faea27bff82727fe1398ec
  • MD5 3bd0b1b85dde9cdd39a0cd135516d515
  • SHA1 2691c275a2d17070a1675031b2c769ec03dd128e
  • SHA512 52baa86ba6a1cd6a4489da2d9add9c93f0a7f6a01a944fa484f001df6dd009b6cf495f09029df2dccd4c6319df5e882c57a2a680f20f8e306b4272da3e265f70
  • SSDEEP 768:EUDlQj1Zx5qtAk8womL1MlJF5Pr9p5F6iOwhE3/ae:EU6ZxEWvBJLFp9TF6iOweB
  • TLSH
    T1EE1339057B918625E5FEABB519B266070731E6038E23D79E0CD892DA1F6BBC0CE407D7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2