Extracted

• • Target

    52853393ccfb323ec997ed2484f89aeccb790d30473447290d94214484920f6fN

  • Size

    69KB

  • MD5

    f9abc48b0f85f12ea5b7e89fecdd9840

  • SHA1

    5990c39a8a55085e2a4135370dea95b94dfb7ded

  • SHA256

    52853393ccfb323ec997ed2484f89aeccb790d30473447290d94214484920f6f

  • SHA512

    e4ec7e40b573dbd6972cf473a595ac8f41e9541ef2fd21a956b3f6ca07b4e264b1b90b34c5dda1650c83c5b7b2df4ca4929727ae47c27be5573ff7c7199a3c80

  • SSDEEP

    1536:PS5NzElzEF7D3EbZvzAlEM+bl7upO6bWO0Lxv:PS5dElAp3Elbez+bloWO09v

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2