Extracted

• • Target

    scvhost.exe

  • Size

    42KB

  • MD5

    4171f38c413ee527c699d6a124738bec

  • SHA1

    65db2ecf73416a1c75107ed0bdb40f9072033167

  • SHA256

    e1b83b2921ffbccb583adc624492872331f6e029c35c880b24940a4d8526c7dd

  • SHA512

    4f0752f5fa6b6b98948d5770b69501e8c5a5edac1cc25ef49ac904428fb178199d53aef92aa93411d88df60c3270188710f29a87e2e599b307bbfde943f2d0e7

  • SSDEEP

    768:eEGcr3BbT4UAd29etN8cuGgFFRPy9dN6TO5hiW5y:xTrR/RI9IF09dN6TO5kh

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence
  behavioral1behavioral2