Extracted

• • Target

    dc535675df47e762a771611cbd06f1ccb2b1962ccbfca914a3448fef9ffa9d78.exe

  • Size

    86KB

  • MD5

    de16a00b42e978595cbd917d10ceb984

  • SHA1

    fccc091d3ab6b4c26449e3a4ad0bc5eda73b6a7c

  • SHA256

    dc535675df47e762a771611cbd06f1ccb2b1962ccbfca914a3448fef9ffa9d78

  • SHA512

    aea3e18957bb3edbcf6a08fc43ed0e7792cfcd5a3c1a4b8a017b92e0467129a3879d3282ef73b505e49440fb34f294fc7c50712f6c8bd11b55d710004fed3122

  • SSDEEP

    1536:EW8TIhv1Cz1WeVB/afL8IT+DQX9Ea+bnJEsmTtjD0H6JVapKVX5OwoKxA35:ER0Z1VhLTFr+bn2z1D0OVacJOXKK

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2