Extracted

• • Target
    97507bc650eeaa811f115c8701e7ae11303e590538c1adc21a157574d0bbcdd3.bin
  • Size 322KB
  • SHA256 97507bc650eeaa811f115c8701e7ae11303e590538c1adc21a157574d0bbcdd3
  • MD5 77eb765dae5ab75f54f359e03093c18e
  • SHA1 0cecc4ae1e7332765acda0ac32ea5ba3827d42be
  • SHA512 a230f446b9c11806c111ec54eeed334670e2b640a7d92750e71435f3e27ec288e41c45a22a9693e3796175251f932bce40fc6ca4b67d4972622c365702761fb0
  • SSDEEP 6144:ew4xPPBMDow+mlq2e2jM5CQeQw9ephyytDgdJ/l8OLOU4v7/:ew4xRWofmlq2dM5CQeLsyytcdJ/lUv7/
  • TLSH
    T1FF64122AC0D85108D29BFBB245B319607721F4EC581697DBE0C3122E5E687BE79FC71A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistencexwormprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies file permissions

    discovery

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2