Extracted

• • Target

    fXWlfxf.exe

  • Size

    270KB

  • MD5

    b08e25b2e7527dd37baa4352cf143f81

  • SHA1

    5da381243e460e32388f1f0f33988e98ff3cc38f

  • SHA256

    5d3f76dc4c4191ac7baa3ba130abdce26bef47962e7c33645e0a30dd6635eeab

  • SHA512

    2083a53f24c6061cfd6de5b486fe8794730ec964615e8e2dc009e1d5b0de8880f0f8bdb915c860bd79a34f0e8e4b76abc3aea10e36f36b4cabd1a93db1e27853

  • SSDEEP

    3072:+qom4DMrhHWjYyEH4SeeSy7ZCyRlhGSrt1QEiaZiPm2s1P783FzHkAnOfGPxwq6T:+qomfYSerypDGSB1sqq6Ys0M

  Score

  10^/10

  xwormdiscoveryexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2