Extracted

• • Target
    DRAFT - YML Draft BL I209493748, SO Y171 - YM CENTENNIAL V.045S.scr.exe
  • Size 541KB
  • SHA256 ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb
  • MD5 07dde049463fbfb5f7fd98ae179dce42
  • SHA1 825b4107184b769deed76a3237dd4d3d4425f1b9
  • SHA512 c3240d7ce73e244641340e547d2bed4a9068557fff0bbe5e25520ed286cc0ba8e42d4be05a526e612ac19d73e2579a7dcfec18c8d47c244d666956c7d4ce34dc
  • SSDEEP 12288:5gsrmSiqyJMVD77D4/Kj0IjLv/rlZiVQNQqLWukPgSc:lp5O4Qyj0Ijr/vWELaPgS
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2