Extracted

• • Target

    Minecraft Checker.zip

  • Size

    49KB

  • MD5

    daf6a43ce1f9c897df8eb447489b8d5e

  • SHA1

    d3496e70e86fe898094ce11d35e07082127025b6

  • SHA256

    3db2c2a470737ef9670ead53cdac6a34347a135b42a8334696216b5209de80cb

  • SHA512

    1880623205152d65904450e184516beb88d669f85d4880fa141b2363e34fd3be362725961ab1e1b0741ee17b358311232a7a99a33624c604521d008d88cbe9fe

  • SSDEEP

    768:k0pY89dHb8tld9KS9kxvL7+Y+1SAoD6lNzdegt4ByPRoI/83B6S:DpY+8l9x9GL7+/17eO4BIomQQS

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1