Extracted

• • Target

    Solara_Update.exe

  • Size

    234KB

  • MD5

    d1e76f6454d97b1b4bb21980abd9fc98

  • SHA1

    03b224f0f11e3768f8c62fa02dde36a17aeb4a6a

  • SHA256

    d3ad612b70e6d6cfcf75d28132d9d85e47579b532002e13f17acd597f13bc6a3

  • SHA512

    70153899ae2ef5f0c9f2240cf3ae9f6d30921f2a27014dccf24883273caf9f1c1769f8992c23357e5dc460e243956a0949660d0ea96368518a2613c8651145fe

  • SSDEEP

    6144:BzcIVyx+bmCmh/5iJbb2q7eGD6sGuS1j:BgV4mhIaqKc6L1j

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1