Extracted

• • Target

    SolaraBootstrapper.exe

  • Size

    266KB

  • MD5

    bfea4fbe1ad2dc882c79c09f103fd395

  • SHA1

    48d80787945fc1355ce97ab5dc795cf0e7b25f01

  • SHA256

    2a03094b59e5dbc2e69fa76f01a35c58fb5466c9b47b87d621fb26b0b037ee59

  • SHA512

    2043da716ff26e1fa635a2e13e2191e04c2713ae05eca35540d4148dfbcd2ced76ec977419c10c7d164b1fc0336cad4d7c70267307169aae50c4577484b4204f

  • SSDEEP

    3072:xnkK65+bdKBfKOwcliLvAzII9x66AOag74srxxVfPWKvQIFY623:xndbbwxPqONxTGqQI+62

  Score

  10^/10

  xwormbootkitdiscoveryexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2