Extracted

• • Target

    Official Nova Launcher Fixer.exe

  • Size

    121KB

  • MD5

    11f6b755147b4ca6b441620c0ac39268

  • SHA1

    c93ca611430e685572cbdd7b762633a91b0671ad

  • SHA256

    d4edaa6438dadc7c0b82655a5fe3054ddcf2932f55a177a0f08919484f930796

  • SHA512

    5465d1e5df7a0e34bab7c997a777b86ea447a3519ab993e65216b9dae54e6285ae50b953979736a87b748520ef502a3c6e513b0f4bcdf864addb9247caa1562b

  • SSDEEP

    3072:paPSy6sZ7z/N7kvRS6s5nTsz4IwqJOSIHbBFiMa:tyXrNcNs5nTsyHHb6M

  Score

  10^/10

  xwormevasionexecutionpersistencerattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables Task Manager via registry modification

    evasion

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1