Extracted

• • Target

    fixer for multitool.exe

  • Size

    62KB

  • MD5

    77e7b58ce0b69353d9f95c9e682b6f6e

  • SHA1

    ba83c3c49a507a9c7b7eb3785fd71f4e1ef66f27

  • SHA256

    cde4fe473069363041f226b082f01df71b5f9ac35c29aa5d09629c927f810f60

  • SHA512

    ec6d834502999f93e68c31d4f27ea58ea8a7d0eaea71478ba7745b4f1b5651319fe650d5c430628221a57057be99836c8435fe2b1debed55b382067aa8d1d3b4

  • SSDEEP

    1536:M6EtTyVXBeRi6hm9bTedYcNO67OyO4+Sn+e:YVyHvKm9bTYlOyO4+e

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2