Extracted

• • Target

    07052024_0852_loco.hta

  • Size

    10KB

  • MD5

    9da72d990f0df4b01314b03d824ca97c

  • SHA1

    97166c7480ff92b62469c7eb00390ae294c52fc4

  • SHA256

    19ef64886918d56e1492d010d949d71d5a028d6bc10ed0eee90fc141e491eff3

  • SHA512

    c61957008dcc7bb4fb8555f5fba726a0ce194e6b8692a8f7613977c5526ae8af09510b990e6c600f8e86e97d85c5d72d27a0dd3e55540969f637936f5e3dca78

  • SSDEEP

    192:+oTPT8cVkmolsIqZAsAsIqxEMTPgdlsIqTEbLzpIHuFqbubzAvu2/kKgnkBUR/Uv:N7T8Ykmo6LF7gd6iLzprKgkBU1Uo5NEf

  Score

  10^/10

  executionxwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution
  behavioral1behavioral2