Extracted

• • Target
    Sahara.bat
  • Size 304KB
  • SHA256 5505e8491812e56bd27242f6598df665db7dfefef6a241280973913b84a903ed
  • MD5 0315e971e239cdd0ddc7e6b6a69b588f
  • SHA1 ebc3c22a51878f367b9be9685d7782ec9f8daf58
  • SHA512 0b11a2f5f5ffed7c67812771464a8edd47440bf6ffb85d7a6d29cbc12f32af5a4f180cd3d479ba4268f16c96432538bdfb86cb36ff73877e69fd822aaa7e95c5
  • SSDEEP 6144:AKJ35IN40Z4VEzlQOwTEuAhKEyvXeNFAr47U8p7zZUEoPLoTVqrkGyAyaa/W8ymy:AKJpcW0cE3hGvXgAZAzDokTcMBaaO3my
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2behavioral3behavioral4