Extracted

• • Target

    b5e520b8f9aa8fba0e106406628802faf9fbc927bf2a09aba6270afe3b0a3c4c

  • Size

    59KB

  • MD5

    13f8ea6f22766a2a3fab7161647b1d00

  • SHA1

    af696ffbb96d8dbb29077ab11c4d2f91f73b618a

  • SHA256

    b5e520b8f9aa8fba0e106406628802faf9fbc927bf2a09aba6270afe3b0a3c4c

  • SHA512

    c0903a9880f4560797fa3dcac362990969529811acdbebf78108ca53a636065d3f1915a73e2a6caa7fc059b2b5561d972b4aa62fdb83d1fe8c4116b2294cd9eb

  • SSDEEP

    1536:zDT94NmEa2JFvnkbAqjniRfi6N+yOUtvJ7:vTvEa2JhkbAq+xOcvJ7

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2