Extracted

• • Target

    dd084eace8def7ec82b68be818d0ddaba7ba14752679dbbdc5d8af4c1fc9d948

  • Size

    68KB

  • MD5

    dc09aad6c4769d9368f8fa4122091f6c

  • SHA1

    f39bd3c6bc1ff8d46f8abc9dd8f1205e52162448

  • SHA256

    dd084eace8def7ec82b68be818d0ddaba7ba14752679dbbdc5d8af4c1fc9d948

  • SHA512

    09d868e0d08e38d1d69e4e43d53f0ebf5e86a9f95528b095a32234e99b12135fa831919eae37ce17a671c02ea6665ff6187e1b560e0291d094fabbb4df782021

  • SSDEEP

    1536:7G4OjORI6NHEv9Q6aY9I+b5mtRQs6h6RF6zOtqIwaj:/O0dN4tF9I+b5wRAO8IPj

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2