Extracted

• • Target

    jjjjj.exe

  • Size

    693KB

  • MD5

    4c138aeb4795fde4e3d9c5b2c6765521

  • SHA1

    d49e76214ec5e269435765b7921b9f159205942b

  • SHA256

    686900f495cffbd18b113fe3662e98c000a2a6365926ebe0d950c7d5d1b759c6

  • SHA512

    93211f44410170fe7f48daf43688aa0190959386aae3e783e8b4a11d4be9e638a55aaa17b8227de330da0b5dbadc56a71079b627ec1b293990f0c44779df3d7c

  • SSDEEP

    12288:cAxwxpi8hWPrmq9oheVVFPuUlk80CyyIsFcJzr:vx0rh8rmJAtuUSDa2

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2