Extracted

• • Target

    238bd89de11cbe6b00e7bf57f13863394bed494b73d09570011f27b87270b51a.exe

  • Size

    7.7MB

  • MD5

    027ad6a104d074597068c1781cc0c90d

  • SHA1

    b489c6f4d29db588ecfc65df7ea92d6c23de4a20

  • SHA256

    238bd89de11cbe6b00e7bf57f13863394bed494b73d09570011f27b87270b51a

  • SHA512

    0e3beecff23c8d426d859758b5c9aa4490e5d47ea69e4301c73fe499bd6535ec8dfe22dae552c8e14203d78768cd2ccfb70f78e876de2ba4b2532cf502b40e4f

  • SSDEEP

    196608:xKLCFU/jHq/puROyhxeyOC7+oiRkbtejBe5:xmq/pkOYxehohbt

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2