Extracted

Extracted

• • Target

    XenarWare.exe

  • Size

    126KB

  • MD5

    ecb66b5490aa1bd639d941e1b0f771d0

  • SHA1

    1978eca98549a3e3c3a7bac57aec7d5c4b88fbed

  • SHA256

    7c5a8fc31217bad08b20cb8682bc68e32ba37061671dd9a2f71e4cfd6c9c4bb4

  • SHA512

    b9e470a9ea19542e3674f96e27b1b97261d4b66a1a9eed2dbfe211d9726c0213b4ad03331893ed1bd628d046619dcbfd7c20d438d5c302ba597e22f92a168843

  • SSDEEP

    3072:A/25jvDSgsqsb5Uh28vAbTV1WW69B9VjMdxPedN9ug0z9TBfFSXb/:7tzsb5Uh28+V1WW69B9VjMdxPedN9ugT

  Score

  10^/10

  xwormpersistencerattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2