Extracted

• • Target

    hh.exe

  • Size

    67KB

  • MD5

    ecc0117da91937168d95f94fe2b28840

  • SHA1

    f7c1c88b17173f9403536d0ca1fdfdbb108436e9

  • SHA256

    3cc41a56daee0331512d04dd40e33676820a11615a0f808cb812d496b3fc3a8e

  • SHA512

    b5ed48db56c494396f8002dd61dbc10ca38f3487a9117549b43d3c59a4e580b5e3dc084b62eb5e0b7fc82900bfab79168bf394bab0de76b6971f45f6c84dbb4c

  • SSDEEP

    1536:RbCAX3g4GePVcAye7hC+bu/uwdVedefBRfa6GMO9RDc:JLg+cAX7hC+bu/9mauMOfQ

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1