Extracted

• • Target

    nigger1243.exe

  • Size

    68KB

  • MD5

    26a3d43a396cdab7acaa54d1e1d844d7

  • SHA1

    0124da7710299088ab4c821ba9f0a0caf2536447

  • SHA256

    8b058d5f1b9a2e7630a95220b00920720e9172057d3d33c42cf36a2af79c34d2

  • SHA512

    e232684f054ebd043a2b93eabf10501f8b481f674056f3a1f51d07da7d355baea6b58bf86151d7d34f4c36597b27c3155e3eaba4062616de26581857a48f31bb

  • SSDEEP

    1536:oatJm9NtJL7ntbirB6oQMxR86j4DumOI8cudzG:oW63biEoRxRtIumOI3uxG

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1