Extracted

• • Target

    LIST.ITEMS.exe

  • Size

    556KB

  • MD5

    d7c03169dbdd363163dbfc5119738c61

  • SHA1

    e51f6fe9f9422c054d7b33e949981239ef3355eb

  • SHA256

    c304f5610e7059e7eb2100f0de1e6c1bbeeaa75d746f75e3561eee5b7fb0ac92

  • SHA512

    bbf5eba23c466a478ec381c127a70fc8e1ca7e0b744cf89606341df918b2d40c5c71f29a1f19532c5a83f886e75393e3744d9ae4f4b9862af22d08e596978dec

  • SSDEEP

    12288:qI/rXQ9TZwetjcQaBJLJ/yd4bIhX3KVaV910N4VtndapxbzVykR:/atjdSJ/HIhHKa9GNitApVzr

  Score

  10^/10

  xwormdiscoveryexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2