Extracted

• • Target

    8c2ab35065a3333cd09bbdc83f6fa6415a132e3ba20d7997613dd96652f0e801

  • Size

    8.4MB

  • MD5

    606521d55f5758265083588d0943dfe9

  • SHA1

    009dbfdbf2f41087f41d677024f9710e6a60c2c7

  • SHA256

    8c2ab35065a3333cd09bbdc83f6fa6415a132e3ba20d7997613dd96652f0e801

  • SHA512

    4758d7a384d916cef8a5bf4e83290ab0be7f486ac191c35d0f9caa1be9173dfdb530dd023fef4f3896160af8d5d914074669669abfbc8926e9e4d28a22076ff9

  • SSDEEP

    196608:I3eDL8u4LhYeeorukYMmaIbzeMs2V6d+9of9NMj:oKUOpCulMmFXkdvf9+

  Score

  10^/10

  xwormdiscoveryexecutionpersistencepyinstallerrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2