Extracted

• • Target

    aa6c3a8447e5177e7502c684e408c97f439fd8efb998169ceef1c7d7e7810dd7N

  • Size

    39KB

  • MD5

    a0cb0c4f5fed726aa8c95bbd2f230d60

  • SHA1

    a1cdabf75a9a37ca9250337dbad3fe6c0b99d20b

  • SHA256

    aa6c3a8447e5177e7502c684e408c97f439fd8efb998169ceef1c7d7e7810dd7

  • SHA512

    85882fbdc65af89f0616df7c7c16e1ec826dc87ebbd3fb0eb15d8ed1f6f48a82861d07f3a702be1f07933ccb9cbf48cdd4511010b75c2541816003d1b4c56eba

  • SSDEEP

    768:eHDw0pF163l6YhlLJKuuwhSYypufFWPa9bk6POwhwambf:QDw0pF163swVJKuuwhSjEFv9bk6POw+/

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2