Extracted

• • Target

    roblox multitool.exe

  • Size

    83KB

  • MD5

    cb0546adb41f324fcacb08df0f6ea3c0

  • SHA1

    6c1cc4d746858e4ed050f83583e5f882af76b346

  • SHA256

    6ff48a0d7a47aa76f223ae272eb73caa5a8cf343a4e1a165a30017b20511d317

  • SHA512

    a6927e5ec4efc4d02927af38e1c2aed95f8f6350dcc37146257f31cf98786b156035d136c43969b359c7a3e9edcb16504f24be28d229a73fa0cda782c8c52888

  • SSDEEP

    1536:KmA2x/2kxoQkhGxN6Qsv0HokBXkU69bWioLJpJnCilB6KxyknLKqO5tzKH2K5n+W:Km/610CsIyS9bWioTIGTEamqO5gH2O+W

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2