Extracted

• • Target

    30258a07cc6d0fa827544493e9036e955056da88d0530efa8cf3535ecbf8e75c.exe

  • Size

    168KB

  • MD5

    651429675c1d86cf068746159aa66b6d

  • SHA1

    aad51d3448cb1e9f337a985ed840a0064d5699ee

  • SHA256

    30258a07cc6d0fa827544493e9036e955056da88d0530efa8cf3535ecbf8e75c

  • SHA512

    397e2a05e8f3d45c04953998a09d76212b38e3dc9073be814cb3010ea94b00733d2557a6e5002b0a2401fb33d62908e794553a6afd31e45b0afe6987806272fb

  • SSDEEP

    3072:gwe+6Rkd+MisaP1JmK6Hw9hEgXEp1NDLfgAiKgD7fYtB2SOEQW40/mmo0ioi:glbRFLsaPfmK6HwXDXsFglf7gya4tm

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2