Extracted

• • Target

    Luxury Sheild v7.1.exe

  • Size

    7.6MB

  • MD5

    f145671c3c65072a5a49f1d1d68a4a3a

  • SHA1

    2453dddb4e6ebd48604fff3094f6a59dacdc3ad7

  • SHA256

    d5dcde7ced43245641793538f847c55e3271f5ff8eb45fa5616a00634b7e64a1

  • SHA512

    6f9bb2a1c9e4f90c22f7e0675c6d0ab06e0b7875c432d229739000c568a9a0fa5024cd36ec6b947b520704ad706b945371029c24766cac3fb2d509f478dc6902

  • SSDEEP

    196608:ys/RzJU3wXjxqEVJsWEgVN0YdD1TpoSKpgrIMOC5S6F:ys/RzJU3wXjxqELsRmN0W1TUMOCU6

  Score

  10^/10

  xwormdiscoveryexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2