Extracted

Extracted

Extracted

• • Target
    522822101e4aa4be512cd0ac6e1fcc8247711ade9626062d677247d04af62eda.bin
  • Size 215.6MB
  • SHA256 522822101e4aa4be512cd0ac6e1fcc8247711ade9626062d677247d04af62eda
  • MD5 5cc1ab59ae7aeebba3ab3cb92c4e98d7
  • SHA1 d95c84c707ffacf582c8570c5135f56273c702a0
  • SHA512 4fe49862cf50555c2c3339ddb52f23218fbc0deef5e85f051ea092cd67b16ef27524d9f51d74dc81fa358a2a386ee1200044e00b7985febcb5d5ef5105c0dda9
  • SSDEEP 6291456:EV0Yo7pRBPVKGa1EGi7iVQR9ZuRbPN/fz0IXl:YxoNRBPQs7iuRqR7N
  • TLSH
    T1E7B8334A200BE163F31241F8A9617565C1543FEC6B2CFC4A9295BB7E273F451A2363FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  copilotdefense_evasiondiscoveryexecutionremcosxwormpersistenceprivilege_escalationratspywaretrojan

  • Detect Xworm Payload

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • UAC bypass

    defense_evasiontrojan

  • Adds policy Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Manipulates Digital Signatures

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Probable phishing domain

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2