Extracted

• • Target

    Process Hacker.exe

  • Size

    35KB

  • MD5

    488bce36a8946cabbda91977ac002c8a

  • SHA1

    6fa107cb8306e78116218f13ee59130909bd0877

  • SHA256

    0e44f48556c67d7786b44877ced76acdc197b22a813a9369bc763cd8d67d8d7e

  • SHA512

    145c818f8861395f38fc68d05ea10efbf8b38d83fc24ec618b3b442aa02c839d6cdfd213b94815a1312fdd44ff89c1a348a9d98da3be8ae69923202fddb59c80

  • SSDEEP

    768:i0n8WmWOBf2novdCLQJFFGTka5Fyp94/6pOjhZyl6:i88WmWOBaoYLQbITZF094/6pOjrJ

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1