Extracted

• • Target

    msedge.exe

  • Size

    148KB

  • MD5

    fb5350f3e1dc1599e93ef75d0de3b1a8

  • SHA1

    a195ebc55dd2aedbd3a8255128f7769e9b8c6585

  • SHA256

    9c1dd9cff28ed7de7eea5fd29c496fcbb4126a8e9460cf4fb53b604223e68188

  • SHA512

    4c3e76c008a0d1424fe46bccf3893a18c2d4561bbd38e52b57995f0f1982631187df4d31d0f16e24118c2145737f0abcdd948c803f330dfb967f9f05178e5f37

  • SSDEEP

    3072:YDDCEPVk9tf+bCUo9Cbv6OWKe5BV0bUniyimyS:BWbKQ5e5v0bURy

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  behavioral1behavioral2