Extracted

• • Target

    fixerformultitool.exe

  • Size

    79KB

  • MD5

    2f7fb28cf91e8ccb2257834f9136cfd6

  • SHA1

    b8f0f86c33bf46a8af745caf4bc0a8d5878e75f1

  • SHA256

    014f0079149caead324ea0d3adb18d65f607662b8725da7fec7628de4acf828f

  • SHA512

    4e0b8e0268346ddcd5c23d34c8c556eef66994d8c01f06bb5bd19cf1c25f00ee76ad8d0e1edb012ed64ba86a63cbcdb806595cc7d9dfc8ef4d31a4b6ef99c236

  • SSDEEP

    1536:KPlF7XxO2o6rx59bm1AXR8x8KG6GaOD2srtdn+6:KrXcID9bm1k9KHOD2sr/+6

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2