xworm | b602978d3d31bc3b9a6ce802c07991bc8d0d20a17d64b60390f904ce61dbbaa3

General

Target
r6nospywareesponly.exe
Size 54KB
Sample260907-ye3dmafm2z
SHA256 b602978d3d31bc3b9a6ce802c07991bc8d0d20a17d64b60390f904ce61dbbaa3
MD5 76bf8e73edc89d43fad8769fc7bcbbb4
SHA1 997fc2368b83a1dc7ec18e451bb27dc3c279de85
SHA512 ebe03addd1f1fecee6086caa93937ed80ea8c6f306e79696c49671b831c4fae922e9bd08ca467f0e3011f3d3f1f489991e5018d2cfd4d95a746c816abdd363d6
SSDEEP 1536:k7PynUYOpDdiU0ADIb4l0zr3iE00OqjR:k7PynupDdRDIb4cOqjR
TLSH
T1BD435C1477E44925E2FE9FB4A8B27246493AFA275913D70E08C541AE0E23E90CD52BF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  r6nospywareesponly.exe
- Size 54KB
- SHA256 b602978d3d31bc3b9a6ce802c07991bc8d0d20a17d64b60390f904ce61dbbaa3
- MD5 76bf8e73edc89d43fad8769fc7bcbbb4
- SHA1 997fc2368b83a1dc7ec18e451bb27dc3c279de85
- SHA512 ebe03addd1f1fecee6086caa93937ed80ea8c6f306e79696c49671b831c4fae922e9bd08ca467f0e3011f3d3f1f489991e5018d2cfd4d95a746c816abdd363d6
- SSDEEP 1536:k7PynUYOpDdiU0ADIb4l0zr3iE00OqjR:k7PynupDdRDIb4cOqjR
- TLSH
  T1BD435C1477E44925E2FE9FB4A8B27246493AFA275913D70E08C541AE0E23E90CD52BF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution xworm persistence privilege_escalation rat trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender notification settings
  defense_evasion trojan
- UAC bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2