Extracted

• • Target
    b1db488d7814500fa7504d46a6490b0b9b75bec6e1951e14e594410df4f3b4f4.bin
  • Size 21.1MB
  • SHA256 b1db488d7814500fa7504d46a6490b0b9b75bec6e1951e14e594410df4f3b4f4
  • MD5 f05e55d779a2c235aa5805bea15b7840
  • SHA1 6b0e35b795eddc870b163f60db5ebbc7ac9591a6
  • SHA512 ea2aea04cc444a58527acc43a2b394c78ac1738ebb51640f88dd1625b56b300b087a542bd49981e2901b9272fe2ef27f7a77469ed7764a66e7927464bf954a7b
  • SSDEEP 393216:RQSXmHv1BVLvoorU2XrEQ/6NdriLnuBoYecSC2W4yFX3kMUgyCW0xhQk4:mN1BXXrYNdWLu6r5reQT0x
  • TLSH
    T11127334D221C448FDB0327F8156FE6380A72ECB07A57D91DDEE75C23B0B6D8889D646A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistenceprivilege_escalationpyinstallerrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2