Extracted

• • Target

    multitool fixer.exe

  • Size

    69KB

  • MD5

    c0822680b8bcf521199bd778a8ab8fb5

  • SHA1

    a67e71b3fc5bf21f6ca7e00071c5228518a1efe4

  • SHA256

    a66f7f3719c18785c8a658b1b0dde9348753ad8b07bb5407349cd87562806727

  • SHA512

    c517f0cfb1596bf3a3fe6f0754f88f888d232fb3e1755cb0e712f65c90935cbde8fe1610fcf8db4de7f438108359470834cd679290217fb1447243f3732ba73b

  • SSDEEP

    1536:fC0Ffd0Sz4p0+u0yveJm/H96Btbpru75jOzl6JiGcOz3VWFIcvkn+C:hj05lm/d6BtbprGIOz3VWFri+C

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2