Extracted

Extracted

• • Target
    system32.exe
  • Size 2.1MB
  • SHA256 d171b1a925af513efb2e8386c0ab28267187df27945caa41a9c2721f6f4bbe86
  • MD5 9db9292669e2b49c81bcd374465542ff
  • SHA1 7cd929b1cd4be03f54b79468ff58b6bcfc488462
  • SHA512 51dfbc1ae5109322bae277c34eddadd74ab2a66b8b90de7fd30ccf78e90f97a9786e22f47ca158a6870dcbd7d64008afe0ee675f2d907fbd16777915cbd5015b
  • SSDEEP 49152:tXcrVmmNccajI+n8hFaAx2nZeY3EZz/Xd:dcrAmNOE5FaAaZe2if
  • TLSH
    T1D2A533F6E7A69156EE7D4A3F407D2168237707EDC523127C1EFAC6952E74E890183B02
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxbinderxwormloaderpersistencerattrojanupx

  • Detect Xworm Payload

  • Family: XBinder

    XBinder is a crypter and loader delivering a wide variety of malware, written in C#.

    loaderxbinder

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2