Extracted

• • Target

    fa5a74ef1355ddd1d5984b84d52d7aa0727e11e40a89ca3a2bbf4594eea57730.exe

  • Size

    158KB

  • MD5

    1ade097499dd5fb334ffe69d06d00b31

  • SHA1

    ab5e0d3a2e0a71b2afe9a04bd24835a8f5874079

  • SHA256

    fa5a74ef1355ddd1d5984b84d52d7aa0727e11e40a89ca3a2bbf4594eea57730

  • SHA512

    b35aec83bbf5e0501a706df42db4db1b077acf88e37a4d6c65b52c83f24db0e0eb33fad9f22f0a847a14f6540419d85e24062f9c65a2a6d96db5ab20d315598e

  • SSDEEP

    3072:6vpWpop9+bNFwwO52HJe5BV0bUniyimyx:IVpkbEaJe5v0bURy

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2