Extracted

• • Target

    RobloxFlingV4.exe

  • Size

    77KB

  • MD5

    a3d8c1ce63a239eda1c0958acd5f106f

  • SHA1

    d9b5899773d4250cfa80605bb3524a01aad462b8

  • SHA256

    7b24d9dc380ea21160d1e5f753b4992cdc1c8ebf8071cf87f31ec7a7be55c035

  • SHA512

    cddeaab7f3441aeaf19cdd5cd9560f42b8e6e95752584b7faa868728fb442becfb069eaade6d69c64eefcd20922f6800c136cebdd2d896fa1add896325c908ef

  • SSDEEP

    1536:entZ0f9nRQFt8jo2r6+RRoXPGLyTsrG96HIU+bml4cfP61Ak8OvdUCUVB:669nRQFt8jNs/vTf+IU+bmo18OF1OB

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2