Extracted

• • Target
    4e9eb0fee674f5b27887aec706b44e4c191098928eaccc6bc4ab72f0d79b436a.bin
  • Size 49KB
  • SHA256 4e9eb0fee674f5b27887aec706b44e4c191098928eaccc6bc4ab72f0d79b436a
  • MD5 bbf0f7f8e702ada032e595b79222c09d
  • SHA1 eec95c469c137677975e83c28f600256dc911b32
  • SHA512 4ec0b0da11d1a894fb7577cd78a8c78a829ba0d9c58163499ba7a268f9a0536b961ae73835c8fa8279d5157caf622928fbed4904c64d974482dd2ae0ab4dd18f
  • SSDEEP 1536:uJtvWQ9ynZFZXL9TOia82kb6N0K2zvr6IBByWOmyx9:8eQknZFlo3kb6K5yWOmyf
  • TLSH
    T1B6335B48B7F54135E1FF5FB658F12162CA39F6239D139B6F28C8418B1B23A89CD01AE5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2