Extracted

• • Target

    4db566fcdc413fe50153dc8431ae86192241f0e1e86071f80d42eb6e0fb5baca.exe

  • Size

    562KB

  • MD5

    ff9e45d7326698f34526793bf1244811

  • SHA1

    b3ff69abfe1c5e6633a866ffbebe2139a69e3f0a

  • SHA256

    4db566fcdc413fe50153dc8431ae86192241f0e1e86071f80d42eb6e0fb5baca

  • SHA512

    ed2e02262beb00f77c5d17854c7b6544cdb4edce37e870505e21c0cd08999cb99904a667e5ed31cde3a3437c4e9713e6bfc63f091b30a9cec25a046ad0120657

  • SSDEEP

    12288:FDxrXQ9TZweejcQ1FXQEcupRk6CvPlZ0wJOszYkR:ZQejd1BpcupC6Cb0qL

  Score

  10^/10

  xwormdiscoveryexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2