Extracted

• • Target

    fix solve.exe

  • Size

    59KB

  • MD5

    673ce5105eb2c4838bdc2e43142d7e86

  • SHA1

    8131bfe7235e112bc9a4178e656bfbff765748f3

  • SHA256

    20907e4fec14e561984b67cde5cb2b6d75a26ad02ffaa46f9ae0e23a678f6c86

  • SHA512

    2981be70bab43262fbc7ac62bfa880822179a9be14a9c9d0c2c9aff61650ce671d5aad9280e9cbadb1d9d509a24d32f4b97a3b2cc1f4eac3b90718208ff551a9

  • SSDEEP

    1536:XN/QzTH6/AUaeNmHhKcSc99bleVh83w46EOg7635m:XpMoAU9IHhKcSw9blAhOw+Og7om

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  behavioral1behavioral2