Extracted

• • Target
    antiratbyez.exe
  • Size 137KB
  • SHA256 d6c9b4842ae4003265504b6c591806abab1a3eab5d927836821f0e8da55cee73
  • MD5 7952fea02d67d9f58cbd477a3e8071b0
  • SHA1 38ae3efd405d7047c7af4f319ca8224c3c2c1b54
  • SHA512 ece28166895b95973f3d745cab275fb56f7e309b664b744cf4e41dccddbcbcb984ef7f7f38b63ae57980c941908c9406db1957ceedfe0dff56062fbdfe994574
  • SSDEEP 3072:9qjh9Fv9bROw1Bz65/M6If+3Js+3JFkKeTng:ChDv95xBt25
  • TLSH
    T1BBD31782B640C2A1E47D4A73E167E9F10F32BC1BEB06A91F2584FF4739732519D13A5A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionexploitxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Modifies WinLogon for persistence

    persistence

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • UAC bypass

    defense_evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Possible privilege escalation attempt

    exploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Modifies file permissions

    discovery

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1