Extracted

• • Target
    New folder/V1.exe
  • Size 174KB
  • SHA256 0be14df0c5bd8d9cd0871229217d5c920b7a780156eaf9ac777f98cdd5ec4106
  • MD5 ab200c576e4c303cde48d87b30ad3d1a
  • SHA1 1b9cbce1479accb1c64a83539ac6b9ed611cc368
  • SHA512 9b484095331913a0610b548aa1bc0ac8ef8a8e6a1b27a4dd9ccccb558698fb9c41684725612f7716e01c4c3286eacc20439c80e09a76d18f81dee33184809715
  • SSDEEP 3072:U7oNgA02bb9cQ0OP8KBz65/M6If+3Js+3JFkKeTno:U0gA02buQJxBt25
  • TLSH
    T1CD045B41B791C2A1E4BD4B33D4A6E5F14F32BD2BEF06691F3484BB4739331419D22A6A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2