Extracted

• • Target
    2f1a2f79bcbd54d3e2ae43f782d86bb15987477e0fa7b119443ba4c4829a4454.bin
  • Size 183KB
  • SHA256 2f1a2f79bcbd54d3e2ae43f782d86bb15987477e0fa7b119443ba4c4829a4454
  • MD5 fa4f5e60e076b663689bdd5a112d23c5
  • SHA1 a07e46b07295d90b66c1f65be7e64f25f116412c
  • SHA512 26fcd94057c5414770bcff6f91517dea0a503293228a63940e030527423e12d29281a06681c0e58d716cac2f6aded9f9a2549b9fcf4e8bf8322301df87ec8cdc
  • SSDEEP 3072:8szFdVFh9nxOCY4PRnbxB+GorTEeKyhndtOhQp/QIekpcBeFCI04oYuoqe412A:1rh9XPRnbLlor0UndtOKNpc/I31qV1
  • TLSH
    T16904F158FB519618FDAEABB118B1390D4775F2035986D65E0CE88AC72F8AFC4CD413E2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormlinkpdfpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2