Extracted

• • Target
    Fatality.exe
  • Size 57KB
  • SHA256 748104c04b0aee5788852a293dd1c90cdaa02a472d7f7541c96113ad4fcca0b3
  • MD5 ff2b7c7ef4111c28e7ebd02472345cfd
  • SHA1 febf99b9bcf2ebefe591a9b33d94281a604da5ae
  • SHA512 eeba64c9d998de4662d8ef59ff1c7f5d632a8d0e7a43a6628b737e96a9af5d1a5f3cdc9432f1328da94f24a4f719aad3d6ce85927edf85a5bd7ff9c7950ef242
  • SSDEEP 1536:l2e3Kc5PpcFlX0RMWXxCbWZD5bnga6ykRTOpfnh:ll7mXmMWhCbWnnMTOpfnh
  • TLSH
    T10C435B087BEA4136F1FFAFB119B23272DA79B2139A13D66F24C541861713A84CE507F6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2