Extracted

• • Target

    SteamCRACKED_patched.exe

  • Size

    656KB

  • MD5

    e013cc772300564eb65f6ebb9d1f10c6

  • SHA1

    9cb8f0419e0127664da18f37737077da06b45a8b

  • SHA256

    1645991919fd66fed7adc8f19d4600b46fb86b54062c86e76279cb0f74ac8e42

  • SHA512

    c3411408609d08434bcd8ef34a3b9bbbc17b670d6400307dd87de9a1ac1c314ca87db2441073c30266ab051b8d3b0485e9399944c6dbd1989ddb8409b676ad43

  • SSDEEP

    6144:PtBmb8WHz0L+GIIIIIIIhIIIIIIIIIIIIIIIU:lXmL

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  behavioral1behavioral2