Extracted

• • Target

    killa.exe

  • Size

    90KB

  • MD5

    b10a0f0b6e05e80663004dbc5b5c9ccb

  • SHA1

    3d2c39b8446ea808952461192796977c8da8d69c

  • SHA256

    86ca705a2d8b90684b0c4ab698e28a6661ec6248131face07d6e83b593aea931

  • SHA512

    0b09e3e4fcc9d22bda69eaa5d174d972a21c178c42d4d630ec34b137e0aed0c58fa1ecddbb7fd25b0d6276cecc5ca5434b9e23ef031121501d1467cf14e139a7

  • SSDEEP

    1536:WuQ4ZetkrGAPElv9LrxssKeIw0BK7PJ2rO6m/b1rZ7RAs8I/8gNPAAgbB1WN2qtP:potkrGPllrus2wIK9J/bpZ7RApIZNYAf

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2