Extracted

• • Target

    edb8cc2548ed59dc491c0a1cb0b4907a2235b13bbe06a880053bbab544f91386.exe

  • Size

    528KB

  • MD5

    046dc61545c4ca911c25cfc844b3b00c

  • SHA1

    671cda72944c3920edb83520eb5d2317af0c60cb

  • SHA256

    edb8cc2548ed59dc491c0a1cb0b4907a2235b13bbe06a880053bbab544f91386

  • SHA512

    c8024a51ede593157cc7a881a8587536cf010c4c8f9838e44518371dbcec12e96fcac16742617eec414f6a280a5abbcf8d9fe3bcac9c04b75049006f2d93af6e

  • SSDEEP

    12288:5hU2ft8hWSxwvzeA5ScGZshgwnmnmalFYCJVM:bHfuWSxWRGgLmnmaQCJV

  Score

  10^/10

  xwormdiscoveryexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2