Extracted

• • Target

    1528618cb729ad8cd53332e93a75ca4b7b1e2ac2fcbb5a5d33b8bf4ec1740201.exe

  • Size

    62KB

  • MD5

    33f2e0edb3d56165f186cb8ba0d8346d

  • SHA1

    240c5b0fd575ae1218b54f50d8f7b279f1f8958f

  • SHA256

    1528618cb729ad8cd53332e93a75ca4b7b1e2ac2fcbb5a5d33b8bf4ec1740201

  • SHA512

    18a8bf379160fb850e286b933e37a96b965bd4f61e6260aff3ab01077c8245d6637e772bc5b1e1b0ec44c9c60274150d4fd132950e9885a618c269a61ac69b6b

  • SSDEEP

    1536:jdQoncyC0zO9DOvOQuXCDsl+b9mEYzUBrk6PJMVOc6dP9:5b4iOB8jri+b9me17MVOcW9

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2