Extracted

• • Target

    downloader.exe

  • Size

    30.1MB

  • MD5

    26686671cb857fa066747e543626cd5a

  • SHA1

    a89da87bb0e8143da8e78bb12a42a814a33ba1ed

  • SHA256

    775c6da13228f326094fd72815ab3e496a49bff139c98478567def07e21f6e50

  • SHA512

    dbe9544f0cb7ca75239fa2042c4902d6ec0e4a3679be409df187609cd1cbfdf4f116892c9b083de4c39ac6dde40d524eb7719c72de091763213a105fd71f8d2d

  • SSDEEP

    393216:R8oimu7izBxR3QRzhzvQ99Sq8lu0q5tDJKoWSxJGBL7aumo+AJCcLKAE:R9w9wD5xUeubJCcs

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2