Extracted

• • Target

    583df026cb00262ddb8bbe49d7bf22112113a5207b9797d11a2654c8aa7924e6

  • Size

    102KB

  • MD5

    15d7a58db8aa9950ce53375b2fde5f72

  • SHA1

    a403f7ab69cf2d13cb54f37caa53a69b29815813

  • SHA256

    583df026cb00262ddb8bbe49d7bf22112113a5207b9797d11a2654c8aa7924e6

  • SHA512

    adedfeb38a0c271719214ba7f849867f369567238c8c47679f8a322877de5ad6f18027d73df38e526da05cd0d667cf9ba7af124c8228b5335631f30a2026ae00

  • SSDEEP

    3072:n+AbTnyDZW7Dd4sKmrqwNdYcILP4k3O1uo:TPyNaxKcb2LP4k3O

  Score

  10^/10

  xwormdiscoveryexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2