Extracted

• • Target

    ea5c93dc24d9407736ffb3beda385f0f42eb682f6a654f9891c09f754560a973.exe

  • Size

    78KB

  • MD5

    a8cc2daff88948c5943b0f929ec9486c

  • SHA1

    7ccc506bc46d2887a5d4ded2df5caaac4a6f0203

  • SHA256

    ea5c93dc24d9407736ffb3beda385f0f42eb682f6a654f9891c09f754560a973

  • SHA512

    a965155303de05a89954ebdb53a2a7cee7adc5de0bab55cdb1bda179a321ea93121d932acf7dc87a77cda64962bc8a445da59933492cc945b38c0e7d118802ba

  • SSDEEP

    1536:J6KAswl3j+aQRiS2/rmmnx/7MZubpd9zQDACmqGn0LX790kCX+dgp:J6OD6jzxjPLxUACS0LtCFp

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2