Extracted

• • Target

    https://cdn.discordapp.com/attachments/1242148692295684136/1243270923709321226/Planet_x_loader_.exe?ex=6650ddc7&is=664f8c47&hm=690b0b711604fd604df670014dcac01f69a6945635377232e8a41ea06c73c6d9&

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1