Extracted

• • Target

    ea89146ad47697f8a4a55101c1df6968b0ecc247439ed3e9bb7c15eef54ae00e.exe

  • Size

    85KB

  • MD5

    9fd2b5615fe45e09f52e280823633662

  • SHA1

    55816fcadff841d76b00e5cd32869a586bdd7f8f

  • SHA256

    ea89146ad47697f8a4a55101c1df6968b0ecc247439ed3e9bb7c15eef54ae00e

  • SHA512

    b9170e95e2e2b0db7ff364840e8260eed8f37cf4f393cd3e661be9b4309ad44e5e0c891e2a026e84e8b605a9f1ecb805ed8a2e48cf2dd559306a86e34cd58a17

  • SSDEEP

    1536:wgLOZCLbRcbwXpTpli0/eC/CiAQRbAwO4c06Qe6ulOfBIWZ65hUV6faFl:NLECL9cbIf6KRbAm6QelOffeLaFl

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2