Extracted

• • Target
    c61d0c7c89642094f84c1090ff02f54184fdedbb3ad2abfb0641cba2155f04fc.bin
  • Size 1.2MB
  • SHA256 c61d0c7c89642094f84c1090ff02f54184fdedbb3ad2abfb0641cba2155f04fc
  • MD5 3b08717ff46723839b15e56c664fc585
  • SHA1 517596a184e3c90135eb29bc40539724b3fa7e59
  • SHA512 e5a0c23b55528db6c1850712f5e9be420b86a98de179993bdd24cbd584eb91c1647e761638cc0a5d2f332a23b320172dc9b2e439771c57cb04496e6dfd11734b
  • SSDEEP 24576:iGIQPkD2QuqQJooCRWQXr6QNQ4zliLVa:iIkaQTQR8XrJJQU
  • TLSH
    T155459DD835D0F09EC41ECB728D4F9C3895306C7646C69106D0B33BAA793CAA7B9375A6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2