Extracted

• • Target

    BRATS V4.2‌‌.exe

  • Size

    9.7MB

  • MD5

    d7c805799b6b0b1a16223e4953d7d3d6

  • SHA1

    84b9208b01fbbbec5995328945ffee4205a31fcf

  • SHA256

    7bd2fa279b432eb8afc962e951ae03d9036adc8f381d315c8a846f4c5877c215

  • SHA512

    0b0e054f337064d8d0c7b2ccb03bba8f2e3e6c4ab809261747082e380cc309980c6e4e8b19095e5ef1885beb5bcf17a556c08b7ee9ec9691a05fddd1cd5c9951

  • SSDEEP

    196608:fxma6TVvueQBN7l6zrGgRYcZNWnmr2+EzXWLLYPm5ww87XUbmOVsXz/G:jzf78ZacZNW82+spwvsNXy

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  behavioral1behavioral2