Extracted

• • Target

    svchost.exe

  • Size

    38KB

  • MD5

    664ff88f6fe71f59d23e5439b466faf5

  • SHA1

    65cf283a57555381b31b8ee8054a5676aa9f1e09

  • SHA256

    31954ab9f960f8ce45415bdf50b7854acf3a123a348d21e5d4b3b1cb41e52308

  • SHA512

    b8eefa7f9954c951946d83bad28f1a72aa1aa17738c6258d5b4e221da2e69a5785b0804904fc5464739120e5f706d93db67a599e81dcf410f19e24d89d81d179

  • SSDEEP

    768:LONIVARkWS9GriohlJx3yFZV9366YO1hPRP1:6NIVAR6+VAFL9366YO1n1

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2