Extracted

• • Target

    exe003.exe

  • Size

    73KB

  • MD5

    4cdcc052cbfa29daccd43389d7c5afd2

  • SHA1

    c3bffb079f6b5bf2ef63b8e14d199b72b4be8ee2

  • SHA256

    78886dd99890f1d9d9bcf8cd1a89c2bd0bb74d26e3693602cc7d33c3fd6ecbd4

  • SHA512

    b580196f4f0cfb16a907c62c30d812e09d3fa664881d306b0337a149a67edcc3341de4fd9e316eacf2b33951ff972cf1b4e92cbaed561101532054729cfc1a4d

  • SSDEEP

    1536:j7h1eEfP2SP5Ap55v/oI+bI5Nez7BC9z6jFpOObo0:sSP45J/Z+bKNQpOO80

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2