Extracted

• • Target

    5f43c0499a7d7947f5feb5db1a8726f0N.exe

  • Size

    204KB

  • MD5

    5f43c0499a7d7947f5feb5db1a8726f0

  • SHA1

    3eb4045f1287531843d11e52423472b54494b02b

  • SHA256

    2824d0b186c90e04ab56e026c018e7f521e2127bd526d9fca008eaa613fe4012

  • SHA512

    c7aaee50c4c13b711a46511611c27eb2d6bd92ef26b0b7627f63f34ee45d1386cad819accfd267e89574eea21a5f752706878824f4996b9a7faa4d742789752a

  • SSDEEP

    3072:1NDwKYtjhVFv9fHOwN8SKfbzxcwg7es6/Vsb8VKTup49oJMfF/H9N3Ky9NzLn1:1yhhhrv9jUhcX7elbKTuq9bfF/H9d9n

  Score

  10^/10

  xwormdiscoveryevasionexecutionpersistencerattrojanupx

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2