Extracted

• • Target
    9201c119ab4561b14577c0acd3a319a4fdb5abb82ae474375486def5593343d7.bin
  • Size 196KB
  • SHA256 9201c119ab4561b14577c0acd3a319a4fdb5abb82ae474375486def5593343d7
  • MD5 26c51bbb68426f5b0eef38a47824f5ce
  • SHA1 71efe224090e5af27720df4614e25a6620df2aa6
  • SHA512 8e37e4b16d98a9fb5efb1455bb54ed866e692b55d5c186bed9c93ac523af2ba7b1db8bb23e66ed6bdf1039203d68a33184c43605955d6f178caa5109114d6fca
  • SSDEEP 3072:pIlTJK7eVYX+buQ3+nVOu3oGI04NpVq8BxFRzaqF+o2GQJ7/JzqVfGvf:aVbF3MYj0gVqwlL
  • TLSH
    T1D31408285FEBA202C46659747D7363818A3D6F75A4CF75168EE33FEE1BB3C9411120A2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2