Extracted

• • Target

    WindowsHealthProtect.exe

  • Size

    157KB

  • MD5

    867bd1a3adb00960ae067e0a78eb8169

  • SHA1

    7ab2c2bbdd6dc7c8ae9fbbaad09a323e28865371

  • SHA256

    324a08c32241c38030bd495b74411382b6694dcf74cf66caff1d15b6b2370c08

  • SHA512

    5937cd0f869da3f00095319ca53f15bc924f512895676b33f9085a0ef21b5f7e5d33acafc7e47b4039f543980f73dc5a92bee19556b14588e524b9137e4c3c19

  • SSDEEP

    3072:MCaHVqFw9CwOCVJ4NpVq8BxFRzaqF+o2GQJ7/JzqVfGvV:Hw9/gVqwlL

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2