Extracted

• • Target

    b399f5d239807fe144ad8872b4111002ebc6bb79ea6faa417db37f5ff95100ee.exe

  • Size

    504KB

  • MD5

    dd81e5afcd1a13eee9f9a28c6cde2a56

  • SHA1

    cf99a76fc406ffd81c62fbf07bd65c80eeae293f

  • SHA256

    b399f5d239807fe144ad8872b4111002ebc6bb79ea6faa417db37f5ff95100ee

  • SHA512

    b63633f877d4436bcd549a5bd79566d7d3eed7d3429ad44580b6f295caab9e44f562f45855cad6dff60ab5fbadc89c97289c31aac3b45e7f1df0476e610004be

  • SSDEEP

    12288:uNIRt11XXjNZgYjirxY1dZqAi081zY5usx+XtJ:uNIp1XXjNIrq1S02zYx

  Score

  10^/10

  xwormdiscoveryexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2