Extracted

• • Target

    SecuriteInfo.com.TrojanX-gen.3121.2403

  • Size

    552KB

  • MD5

    6d4f51a238fce25887b0e3435fbf7fca

  • SHA1

    6429f96ddf4737322799bee57dd42af539d4df77

  • SHA256

    76ac8355a799b81b7adc8b3a3ee5f6f64f4cbd2ef23a421117346505da71a32c

  • SHA512

    3d3d5d1d6057e4e31c0aca4413cb72d783cef910ad1a5eb1f3e52d25afef04e13a97883acecb058f962dc763f9589cd20df87d3efff50c242aeac4d4c0ea891e

  • SSDEEP

    12288:/nMfWWNP0xC0eQVtJzJ0/jj4o7t8Xq3L8VRtoOsF:/MeWNPECratdJ84XXuUb90

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2