Extracted

• • Target
    4e91d1476b5f8e6f13284e2fab78a369200e8a50b6c39a3e80adae6101f3b62a.bin
  • Size 39KB
  • SHA256 4e91d1476b5f8e6f13284e2fab78a369200e8a50b6c39a3e80adae6101f3b62a
  • MD5 795db904b4f16f62cc735c5b67ee4c28
  • SHA1 35a624109e5cc0098f2770ae6dae86374e2cb610
  • SHA512 77057c8c6056a76e537cb9360c8866f67164fa1faaf29eb33339a291fe5df882166b7996674dea4b6de68cc731c9627bc9ed888757b44e4faa81870ba6f222b1
  • SSDEEP 768:SgNshkjiUBwg/QjHFKuu3amNzHpufFWPr90s6POwhvaQqr:1sh9yJ/GHFKuu3amNEFS90s6POw9C
  • TLSH
    T1E9035C48BB908221D9FDBBF41DB3564B4B31F6039A13D74E0CE4869A1B676D4CE803E6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2