Extracted

• • Target

    product sample requirement.exe

  • Size

    438KB

  • MD5

    07d5a83558349a82cfa1dc6d68f4d84b

  • SHA1

    064af18045030703bc4c62c99f1abe5700832e8a

  • SHA256

    096b33571e80d18c1763a3bd5d019e3177f1547b3ca6e6205a349075ce2fec18

  • SHA512

    aa9d794e0ffb14163f3d1c2df374b99da287b7ce1df965e271921a700a9972c6ead3830f0319eb9ec2d1352e2c0a06bb192045e482b2d54fe091c29dc58946bf

  • SSDEEP

    12288:pMFo7mq6/FqLzEvttwVnGUaGtyk6JXFajEHUC:pko7mq+I/EOoEIr

  Score

  10^/10

  xwormdiscoveryexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2