Extracted

• • Target

    f8dbc4373a048b0c649a6f8ab4bc3e9834911846175be93564afe23eb21e4973.exe

  • Size

    40KB

  • MD5

    7f216847540eb24e6b645d97d6836f95

  • SHA1

    972a3de4838c5ea7ed10cd6a318942e4ddb0509f

  • SHA256

    f8dbc4373a048b0c649a6f8ab4bc3e9834911846175be93564afe23eb21e4973

  • SHA512

    1c20355e247c60b194261a49f5af65f96432789ead0ca289b9685245e3579ab19e64f96279815d9b520ed7ad025f5d6d6764391a9266ae0a8b5b61d9fbaf9692

  • SSDEEP

    768:9UIDwCrxY4mpc9i32v6hCuuJf27ZZfFWPG9//v6OOwh9jGb2:9dDwCFY4gckGwCuuJfKFv9//v6OOwHCq

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2