Extracted

• • Target

    Builder.exe

  • Size

    765KB

  • MD5

    6bdeb48089f5812a21bef4226697c748

  • SHA1

    7c39058e8ef2c5c34f9718bfd0d92f448fcc7dd4

  • SHA256

    16fa4a9b4898751c6ee4428f8b365fe3301b8f477ae12790e16a62acb149ac88

  • SHA512

    00ebc44550e86b2c98079dc033b0f45cec7787708d69e283a64adfdd9250e1a3ef02b4c6d9da4fe3dc29c2e3648d9cfdcc19fcad4b1214384a19421c9f13eb53

  • SSDEEP

    12288:d7+FWC3IYQ1QdzfREFLfkiiUh7X6hXw9l9wkBEnemOB+pTF2vi4LU8oK7MLpX/51:L2vZlQfkiiUhj6yH93OnedswvHYNdX/y

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  behavioral1behavioral2