Extracted

• • Target

    9b784a455868d9670106d82c504421506b94c040f1aa8d3bf129d6306b4db287N.exe

  • Size

    76KB

  • MD5

    51b18ca06caef067d41e3f55234ce9d0

  • SHA1

    5346383ed9415a479c9dad0dbb7eb6ae6a5545cb

  • SHA256

    9b784a455868d9670106d82c504421506b94c040f1aa8d3bf129d6306b4db287

  • SHA512

    48ec46d289f9075bd89682a070a79bc5ed832fe1fb6b7c31e2a4331550bddc2013892784e0fc9433035800b188e9a683fc1bfecfd1f75678db18be87c16b6cbb

  • SSDEEP

    1536:uAyhYQDNkoAVOV066wJZzZ+bDyNiQw4gH6DD6O1+WPeURcb:KiEmoAwxzZ+bDys7OsWS

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2