Extracted

• • Target
    ad0d38631688ed521913b38dbc0b128c0c9bf3dadb6889cb6897433907a2f152.bin
  • Size 41KB
  • SHA256 ad0d38631688ed521913b38dbc0b128c0c9bf3dadb6889cb6897433907a2f152
  • MD5 84003ad78aa87988491de8cc64b7b6c7
  • SHA1 3cef254b5476a0e5e3e9f730dc834c0f87e94793
  • SHA512 14302698509b7c88a9a2ce8657f0e3d1df8a384f33cd4365ef5ef53bc99fdbc05fca525387d71ecf2432c46e32d0dea394eba9e1778a38cb43c7337c5c2f7364
  • SSDEEP 768:/bsRtmbHIZRqlmk8womL14lJF5Pr9p5xK6iOwhS3/aL:/bsQIZMYvBNLFp9T86iOwc4
  • TLSH
    T189134A057B918625E5FEABB519B266030731E6039E23D75E08D892DB2B67BC0CE807D7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2