Extracted

• • Target

    0a6b6f9b9cbf8a15660c1d5472f620a16aedc318041c00d59bedf220e697e408N.exe

  • Size

    85KB

  • MD5

    70447dbf18d9dc8426a9900ad6c28700

  • SHA1

    ce72e3dafd211af37ee84c07850ecf4b126fdee8

  • SHA256

    0a6b6f9b9cbf8a15660c1d5472f620a16aedc318041c00d59bedf220e697e408

  • SHA512

    87c41914eb2297fc510c65a54957abdead439a1b42cb3a3d1593474d3d3e8a42e42e8341521e12e60fdd0385243dfcb48422e0d84e32d417e08249c963fd58ce

  • SSDEEP

    1536:wgLOZCLbRcbwXpTpli0/eC/CiAQRbAwO4c06Qe6ulOfBIWZ65hUV6faF:NLECL9cbIf6KRbAm6QelOffeLaF

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2