Extracted

• • Target

    PO1807015 - PR-SCM-WARL-07 - RFQ-Order..exe

  • Size

    518KB

  • MD5

    2c79c3ae5e1cccd3bf147a596c211c8e

  • SHA1

    97d5fd0bb77fd3eea9fe044dd0156d8be92e3759

  • SHA256

    4834d023f44256c3b2d3cdc2240e1994a75d0774ee92491eb194f45bd9f7045c

  • SHA512

    b95a1193d3499c2cc7c412eae144286289b1fbccb35b5821f3d313b58a61c3d17846997489cc3c129bf023717313f7c8682832d00e6be5d355cae6c0cf66a581

  • SSDEEP

    12288:QrDDWx2PQfdqCT01PrVxzJ2c0Y7/YbpzWLVOZBI8k3:QPawMdqCsPxxpHMpyEBzk3

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2