Extracted

• • Target
    de823d3c1b8367ef0e96fe2ed854c5ff5ac40f1c7046ce116b071b4614a5ef73.bin
  • Size 43KB
  • SHA256 de823d3c1b8367ef0e96fe2ed854c5ff5ac40f1c7046ce116b071b4614a5ef73
  • MD5 fb0929a8e04470654daae896b4d912d4
  • SHA1 439e2d3af3efdce1bae1cd6c0e163b7f2d1ff896
  • SHA512 f50d307ebe8c909261fffde951ac9afed2e5b0a81db68b60ff67bd080d8b9e71e5051da5ff39b1457761c3798bc4b223afcdd372969ea1dfd93fd0f693cb4a7f
  • SSDEEP 768:vfNLXnCvmio7LvXw9iK6cuDi5Ju4vEYEF0l90Zl6KO3hfYcqP:NrCvgOdzxEFFm90Zl6KO3rqP
  • TLSH
    T15E134A08B7D00625D9FFAFB458B3A1060671EA17D623DB5E0CE495DB1B2BFC08E117A6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2