Extracted

• • Target
    799857f2aa3424ec3d345f39edfee7cd0efe38b86970ca02c4ff1e5a994daba0.bin
  • Size 181KB
  • SHA256 799857f2aa3424ec3d345f39edfee7cd0efe38b86970ca02c4ff1e5a994daba0
  • MD5 45413f126c0f99523d91d2a2f77f8728
  • SHA1 aeff09142e2002cf61ea32cec19445dff0c13de9
  • SHA512 aaae99d4440f65037c56d40897e6080574c9dcacd428e58cd2b76c59e2732a94743b237796c6c6e892df9c44fe11e3cfa2b338a23c85e8f823009637a759753e
  • SSDEEP 3072:fBOwaF/k/auCvix4bvvXO8a4cBJpNgEx+8Ldj/6lV2l5U4By2or7h5mqRlGX2J:fBnalkSuCvi2bXsyCLdT6L25U4ByxIXu
  • TLSH
    T100049DA8D36401B1F2FC56F048E93D36653EAB3FC7063E6F148B52C61E1F6548262B96
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2