Extracted

• • Target

    NLHybrid Fixer.exe

  • Size

    78KB

  • MD5

    3c0e5550692a92a15a5dc3e7a02c529f

  • SHA1

    e25e36a2b15770fb59c3be8f32cb030ddf9c6c1e

  • SHA256

    115e0684c499ca223d9e655d446571a68ba74a94c9a87ef0abab842e786fa585

  • SHA512

    7b3bd8e2a969747b77d4b4a19fda85364801415f1b4b95eac1df8cbb643dc119166c736d9d790f8cf71376f897e5652b7775ddb6baacd362b1c478768ca088f6

  • SSDEEP

    1536:mFq6CwjD0dsHJGJY94gWA3h8f59b4gYD6D4LDSa6AJwOVAdrc8ICmfata:mFq6hjDxcJGcR9b4nIMJwOVAddUata

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Deletes itself

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1