Extracted

• • Target
    Free rubux.exe
  • Size 149KB
  • SHA256 03e754451d13a9ee71012ac05561ab18858fa7bd1d10ab000aafab49442690c1
  • MD5 a2ca74e4da31d686ddc23980928d70a0
  • SHA1 1fd4e4dff6f3a3c20f3467190c35d7bb9f21da3a
  • SHA512 adf03e2d2f7956d0cef884d8d4620f7926b3f9eba8d9d9dc49b7e6e17fbbc96122504fa6d62e8cc9ae004db150b757cf7dc8b7e735e4f7771ca70cdd72efcaf3
  • SSDEEP 1536:N/U4ZxwWoXHhWwF49oD6iOwUG7OybBYfOS4J+1oEhyiHA:N/ZloXBzF49obOwJtYmS4g+EhfA
  • TLSH
    T163E3A49A2E4507F7E75CF53480F3332D237ECE3A3E965E4DE9AE7EA862308491948511
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarediscoveryexecutionxwormpersistenceprivilege_escalationratspywaretrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2