Extracted

• • Target
    e9de8fa6d51d20c3aa3e62f00f8c5cdf617742e09f8373c1c41ec08e7c180885.bin
  • Size 66KB
  • SHA256 e9de8fa6d51d20c3aa3e62f00f8c5cdf617742e09f8373c1c41ec08e7c180885
  • MD5 b0c90770505d0b9b8f297eea24e5ca5f
  • SHA1 64aec95277530e755ba8897f2ecbde5ac256a217
  • SHA512 bb5d052e2ef6ae90fc76ae5c8a0cb9a6db31cb9fd47a84d3bf4009dba9b2b1b9e23a86992705286f4f0631a2f83cd48e7873e67264faece4082adc5af267e4ee
  • SSDEEP 1536:+qH+kYeqYIsulx+G+gDZHoi6akbKnx4f961POa7BuH3Jm:fH+RZFf+WDDdkbKnufgPOa7MH3Jm
  • TLSH
    T1D6638E5837D24126E2FE5FB65CF17167CA39F6235C13D7AF28C8428A1A13A89CD107E6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2