Extracted

• • Target

    gfdgfdg.exe

  • Size

    55KB

  • MD5

    ec7118f4d87eb6f7345c736c6518b731

  • SHA1

    7c98568b3ac601e29c09d589771c6d4fa22dac97

  • SHA256

    142dce4d50bffc85131e35fa916425b5cfc94b7758c7ecf5588a3791efa72d71

  • SHA512

    bc444358189e20b6c7f741dc1126f8035fb4b0b03e8bc0ce5dec30b6b373b5534afd7681d04ed1c7fa21a347bcfc74e26892661d6e4f717668c28d5282164db3

  • SSDEEP

    1536:aqdMs+GT6wUUfjZ7p+bexQV6EO7HpPMm:0UrP+bexgO7H+m

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops startup file

  behavioral1behavioral2