Extracted

• • Target

    fixer for multitool.exe

  • Size

    87KB

  • MD5

    99e39146427de4c24dd3f1ff1ed4debe

  • SHA1

    c7b51946c52c902c5af7f228613cb00660f15134

  • SHA256

    f4c783c56c8cf963890638302a5e92c8e49181b4813f7fa10f2f537ed944ae45

  • SHA512

    727a8ae888af56cdf680f163783c554c076451708a3d80c5147af3a10922d6a8edf65c2ec4cfe5552e79317f9be336623e7be4f0fa5ff6a29ed12e08a7fbcc98

  • SSDEEP

    1536:imR/EoP7RfUQ3ut4LhZm3BuASk1x9bpcRjkHM3amui1/cZ6DGiOKWP1WlGOOn+P:iW17R87UM3BVx9bpLHMqmuIEYOKWP6GW

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2