Extracted

• • Target

    NexusLoader.bat

  • Size

    370KB

  • MD5

    e28bd6a166fb90585df8869440e0bb15

  • SHA1

    064709acaa5bb41c46a969fd6f41ea9a01c07be2

  • SHA256

    d73783e7c4f4a71b3f2041ca730ea2e575d5648e399a9bf53c9ec81b192aa5de

  • SHA512

    fa44c33d60bed56eee9c36c2a52aadb5dbeae60a7491029de8b7989bda6c65a1d8b798041f0f31ede047e9f3e3e5f3a7b325bfebe0d142637d28f98434f6fe31

  • SSDEEP

    6144:3CG9xn/wsS0jtg6MXXOLl+bVg4+N8BZXCpQrYfbREmFAqjKFbR7:1PptSuLgbmGBEpMWbf+Fbx

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1