Extracted

• • Target

    925dcca433ad653cb99eea5318246960851c4dfd69d67cbb978578494af79dcc.ps1

  • Size

    331KB

  • MD5

    ffc19d662d5831753bd6a1e1dce46f6b

  • SHA1

    7ce271ccdeae2f30c70dba1a875a215ee51e2b7a

  • SHA256

    925dcca433ad653cb99eea5318246960851c4dfd69d67cbb978578494af79dcc

  • SHA512

    1c6615b92d998a4b28a2f1afc1d54dd94e94ea6c3561d2bb7dcfc8ceeeb726b2b3580fb2fc228c62f8f042db16a28f849b0d97412a2065510c2b615802a226f8

  • SSDEEP

    1536:k/0mI+fIMtxO/gYOUxUErIsOKlKE7HTZDYjm2IHnfRLlUJMjcI559G7jyD8WUIOQ:kKxwaD5WphZKxwaD5Wph/Q

  Score

  10^/10

  executionxwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2