Extracted

Extracted

Extracted

• • Target
    Initializer.exe
  • Size 149KB
  • SHA256 99fcad0458d8b26b8a566ce54d6d1e4c753a5a7bf5b44d096dfcf196411e017b
  • MD5 245686ddc38f1b62ee95dac100a16f85
  • SHA1 7aee685f9553a5df40efc07c85271d2d0d7f8843
  • SHA512 ba4f64ad0b7e7fa4c5558915a580a585b2901a0e536b0bb9726d3afcfb633efec9507900d801f0561865822d8bcf4965d73d944851735542a414e985fdd1dbd8
  • SSDEEP 3072:etgC4VgISwJ2ThX7JLwvl5OxmARmPqGzvAMlG9J7:etgOiwTt7J0OYAIPqGzS
  • TLSH
    T15AE3EF4129DC432AD1E6D9B11F832578FB33FB86854286BE9C82F2B7F106A44CCD612D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkithackedby4444heckeddefense_evasiondiscoveryexecutionnjratxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1