Extracted

• • Target

    incognito (1).exe

  • Size

    206KB

  • MD5

    27b0f73672fa65b3fd52ff076c63a823

  • SHA1

    aa15b94161338821ce3cd92f0267fb760008fc48

  • SHA256

    6dc9aa9c3b46b0b4b5e5a46f3c79198c7728feb0908083b2005466a80fc01508

  • SHA512

    57b14bd5861a10e52ab99189db8c3533b9c7299b5f6a33dc9f5637e264767705173c7ce9685d20e5e47e7ca69504c005e03111ef0ef1872484793fcda5a802a9

  • SSDEEP

    3072:k6FvyFO9m/O+t8SKfbzxcwg7es6/Vsb8VKTup49oJMfF/H9N3Ky9NzLnK:XvkO9GUhcX7elbKTuq9bfF/H9d9n

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1