Extracted

• • Target

    working one ig.exe

  • Size

    89KB

  • MD5

    3eca2005bcc7a67d5f3b3a46e45fd11e

  • SHA1

    8b181cf225fe7aff9799260bd25805e8b7849a90

  • SHA256

    18e899d8d15d30164b697741a04ed67fa00f377047f63555dfd4231145c6f3b2

  • SHA512

    12a3f62d14628a5ad322dd16193be748eeb8ed8f27f641e9be011344141528576485fa4e3d818a3a2b699949aa415dd6ca0cd1fca3ab2b8a2100f45ae4a05678

  • SSDEEP

    1536:zLgBUitSA/Ua3ArtXqDnz3p53V879bqSWTiDrVJe44706g7P5RAO+x/ePO/sn+Y:zDxf1aPXa79bqfFRy7xRAO8eP9+Y

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1