Extracted

• • Target
    95f6f49f47c618ca4a7cc1691c2e5645b71689d6bb48b3f03f526ea5786744c5.bin
  • Size 57KB
  • SHA256 95f6f49f47c618ca4a7cc1691c2e5645b71689d6bb48b3f03f526ea5786744c5
  • MD5 de308b884ca30fc051e60d22e8ad5942
  • SHA1 4d96779276d078aa13dca0320c95e64898936221
  • SHA512 1e9071868a9f0859a43d9e91437b7078167aeba12765dc515cfa2e1fc0139258c333252ad7f6af61e28536f59331c53645cc8120658ed8df984fdf616b7f3564
  • SSDEEP 1536:m+whdu+RVqeNxIfJMbjVgCWzd6O1Oh96z:m+whmeLIhMbjVmx1OL6z
  • TLSH
    T15D437C1837E94222E2FE9FF05DB23212863AE2179903DB5F28DD05C61B579C9CE417E6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2