Extracted

• • Target
    313f617d53b4a82e2f6c91b866ec41f36069d2228dbcb985ae8c937afc441711.bin
  • Size 40KB
  • SHA256 313f617d53b4a82e2f6c91b866ec41f36069d2228dbcb985ae8c937afc441711
  • MD5 0aeed6d50c670b977278bf2ab72cf2fc
  • SHA1 06c18fbf4a2c5af5549c6c3ba2cccb751fc38ab4
  • SHA512 e6d02a0e0115622c7b1af703608e6bba8610c7fe4be20fdf466bd3f7d96abe73392f6f76a2a1795df993fd58412b2658d5c4464a1797c07fe012cf16aefba5cf
  • SSDEEP 768:ZGmXvGiAanBvlDimb/jm54e4PvnFPp9L16KOphau8ZUO:Y7EBvE29eq/FB9L16KOpgzUO
  • TLSH
    T1F6034D48B7D40719D5FFAFB05AB2A5450631EA07E923EB1E0CE495DB1B27BC08E507E2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2