Extracted

• • Target
    rSO0105-PI-514124SO0105,702(CFS-CY)FIRSYD.scr.exe
  • Size 560KB
  • SHA256 18c4dbab80d7e5adef5c28a522232b6f4b0e47ceba4e37ec1f7e2b17495f9c64
  • MD5 1dd6c8f62a1b2756b157555122a15e08
  • SHA1 88eef0a0d0d18e1c7eaf3c0dc5df9dc9d09b20e1
  • SHA512 277c03e3ad30a4baff3531929af8cb4a6a24112e83f16fd61839692352fc1cb700bc406f2991941d22e82cf9af9a322c988b3c9efdd9f7843f7e082137710bc1
  • SSDEEP 12288:/V1y0xC0Tld1psq8ZGLv53Ly15clYxc4IbvZvr8zI6sX6iToOe:N1yECQH1pV8ZGLv532Tg4MvriGz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2