Extracted

• • Target
    cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe
  • Size 509KB
  • SHA256 cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651
  • MD5 ff3aea929347d0168b02de5d2c2bcec3
  • SHA1 fd7eaa628f424fc1384bcbd926a551c8e60740db
  • SHA512 c5ba038472b25fa013852b57fa712a286e56a85f015b68c5e7da72ed403aa0b896deb6583407894ae76dc59e90c475a161504d55202b4b7fe774732b22793c3b
  • SSDEEP 12288:lUrKkGdrJwKcItNXOMaFshRSxD1ulXrvNE53jHd:DcA9NEQlXTaT
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2