Extracted

• • Target
    21585341a4353dedb8cbf0c66f566904736ee3fbf9086ca1d1df8200fee6a028.bin
  • Size 53KB
  • SHA256 21585341a4353dedb8cbf0c66f566904736ee3fbf9086ca1d1df8200fee6a028
  • MD5 69e9139effc3014bd491685998b3ea0e
  • SHA1 7a73ab643014a9263fbcc99f18b1a2a2585721ce
  • SHA512 b125011a2f581b374867f2ff01ee0744d3f81b73be18df4cde2de9b1c9c49662f24f4c4a44f3149242e5804fbcd7280582e3a8e9d1e4e44ef836b00298cea423
  • SSDEEP 768:68/bMjzkqKeCQEL93YlsHdpU0rogG3S/bEYoYDVaCcgh9nYFhrRHmh:68/AjzOL9JHk2ozMbxo9CDh9IRRGh
  • TLSH
    T1DA332928B7D14A11D2FDAF7009F172268676F6025D03E70F39C059AA3B6758A8ED17F2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2