Extracted

• • Target

    ee77fd66103b412195daff2514cd1fb550e61e618c2fa98bfd5ab998e5cd7b6b

  • Size

    99KB

  • MD5

    70481cef66610d13de32339230ddcfd1

  • SHA1

    39d19ccc6c1d77fe62d39b7eda95559bd2969f16

  • SHA256

    ee77fd66103b412195daff2514cd1fb550e61e618c2fa98bfd5ab998e5cd7b6b

  • SHA512

    75e0f65e0a2957a20796c93654ccde195f9c53d821c25a260c4203a2170aa821dbfc9c1ce3b165a41a23d44ef7c033076f1da9fe2691b2087c60b89dce8a63a7

  • SSDEEP

    1536:gCg7wHl8aTciGekb5jPHyZ6xnOEiXChiH0hLP+VVVVVVVVVVVVVVVVVVVVVVVVVm:Gi8ScRekb5DnOEiXbH0hLND

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2