Extracted

• • Target

    b4bbc1012005092e6733ebfafbf36ecf7299a5daae8efd47c15e0269ba5581d1N

  • Size

    39KB

  • MD5

    e3d6d70964cb1dee7c881ecc2392c6e0

  • SHA1

    36c95f2fb67280ade55d5e5a210f8f0048fcfcba

  • SHA256

    b4bbc1012005092e6733ebfafbf36ecf7299a5daae8efd47c15e0269ba5581d1

  • SHA512

    7c71c695c17656a807129e9cc31c32cead584c480fb5e8b699f564a3beaf1adf11b194dcff3fb2eb249edf5754d35c03a5a52e3e0fb24d0aef6ea26f71a53485

  • SSDEEP

    768:oHy/gfUevnMshwZM5EIDPiKuukR7LKtTfFWPt9e96cOMheadw:oHyCNv9hC8EIbiKuumnSFe9e96cOM07

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2