Extracted

• • Target

    Test7000.exe

  • Size

    39KB

  • MD5

    ec823d617d239ce10f01656b18c5d0e4

  • SHA1

    8f17296536c4096ec178aeea963d620210e6d3d2

  • SHA256

    fdc5bfbfef816556a6538fc3a59163a2ff77aedc3fc146285612067ce5cacdca

  • SHA512

    635a8f2ae11899e91a7a46b5ec87ee5efab98878fe8b3fc22e9d8d20e7a3d88e0cd75ce190f1503ad1ac1c331944086b639e2657aabd55055e6fe3dc7eed2bf1

  • SSDEEP

    768:yftYec/H/fCfTvQ5hxx3CAFWPG9EW6OOwhWQmO6i:yftYecXKf2RFv9EW6OOwY5Od

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1