Extracted

• • Target
    485ea1801762a0cc08e681ffe5a90ea33cbb646b8c8b280c2f971652e54ed61b.bin
  • Size 39KB
  • SHA256 485ea1801762a0cc08e681ffe5a90ea33cbb646b8c8b280c2f971652e54ed61b
  • MD5 e0b0a082286969b6e73e9109ca688d68
  • SHA1 3e14dfba5323afbfabc74538f7f5fb0a4d7c563e
  • SHA512 e09a29ea53d208467670181574c387243d74f9ec9ab974e6b2ff18ff2f929b95d59a259f4ea58e932d32875fa5dbaf140a164f1b5f51316e64be289a8666dbd9
  • SSDEEP 768:KNshkjiUBoK/QjHFKuu3amTHpu1FWPr90z7cx6POwhla4k:Msh9yL/GHFKuu3amrqFS90z86POw7a
  • TLSH
    T196035C487B908221D9FDBFF529B3560B4B31F6039A13D74E0CE4869A1B676D4CE807E6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2