Extracted

• • Target
    576011cd432f5c9b18c85c4c0b82223ab719c8a27814285e1df4f4678907ed7b.bin
  • Size 137KB
  • SHA256 576011cd432f5c9b18c85c4c0b82223ab719c8a27814285e1df4f4678907ed7b
  • MD5 ed8f89e2730c3b8ed436536cd1697b03
  • SHA1 1a7cb8ff167fb467aa18269dd7d161eacc4e0b6b
  • SHA512 1c544e2e831f9f67edbc4658007f209cdf21cd4ca03816e8e9e0d127b21ffd841b7be635e4a61f5f97bfb59b52b42223fe1b3f3dffae955551d8e7bf8a604976
  • SSDEEP 3072:1j5L9xIFU9c7OwKBz65/M6If+3Js+3JFkKeTnU:t5JxSU9bxBt25
  • TLSH
    T109D31882B640C2A1E47C4A73E167E9F10F32BC1BEB16A91F2584FF4739732506D13A5A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2