Extracted

• • Target
    e4544aee12aa4b4b4fb5d231b4353e1b605a0c627827db68ffd603f72a9d123a.bin
  • Size 65KB
  • SHA256 e4544aee12aa4b4b4fb5d231b4353e1b605a0c627827db68ffd603f72a9d123a
  • MD5 c78c45c3094f61e0c41797c5f7833b37
  • SHA1 16af4100957a4bb46221cfb548d911004fcbcbfe
  • SHA512 ed7e3c2ad25e910f8c027fd2dce51f92ebda11e50151a9976211ba2ee19863e64de9e528a090cfa29deec5352fd4ddc6b3bd1f324fee04402d29b1f89645ad3c
  • SSDEEP 1536:dSkmJKmKC/WhA7kbKsn/jf+q6FUptcOVrVwvJx:4kmTKMUekbKsLf+UcOVrVwvJx
  • TLSH
    T13B637C583BE14129E1FF6FF119F13262DA7AF6236913E62F24C9019A1723A85CD407F6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2