Extracted

• • Target

    3d25fe2989b3b9505c5b45751d1da232fe3715bff54c6900d82b99e7ad76e6c5N.exe

  • Size

    114KB

  • MD5

    62ed3d4b4bcced663a7cba48715843a9

  • SHA1

    edb117c9a77f0b9f55491ec23f08a55a3340341f

  • SHA256

    23bd40410d0296e31261f08dcb871ccd8965bd7b610d7d1a5d3c9aaf88048b6c

  • SHA512

    eca0fe59599aa90af0963eeaa475bbebd09edc0e9befa6ff8546ee1b806a1f4e7d4a8386fbefdb016f4df33d3ff5b58de4d2338ada8737ec45c50db9725de883

  • SSDEEP

    1536:JjYYfOtuaA3+pfbrp+ZY9QQK676lJOqVChiH0hLP+VVVVVVVVVVVVVVVVVVVVVVp:B0uaA3+pfbrpfOZfOqVbH0hLN0B

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2