Extracted

• • Target
    b25f763cad3d71fdb3014a455ab7b18672ccc4fdf567fe9de1c920538eac7056.bin
  • Size 76KB
  • SHA256 b25f763cad3d71fdb3014a455ab7b18672ccc4fdf567fe9de1c920538eac7056
  • MD5 98a39ec94ddf0c2b02769298f9dc0ecc
  • SHA1 c5a4ff2e5bf62068648c621dd35ffa5e3c1a271c
  • SHA512 a863fdda7e4f5c45fc8d3ede01fe477c667931b6e5b8da4dce9bc9e0c0610533c27e9c766ef5b10e67a14d7bc703af82a29b6e484845226f958fbcbd09961551
  • SSDEEP 1536:WDejXQjiGeJQXQfoQdElIeRb4mVs94GHgr6CEQOE6oxmXvV:W6XuiGIfoQ6lIQb4394GAZEQOE6osvV
  • TLSH
    T1EE738D2877E20525E0FFAFB11AF27356CB35F6236903C65F28D80686521768DCE816F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2