Extracted

• • Target

    msedge.exe

  • Size

    165KB

  • MD5

    8c92b315d88907a31ad9eaa934a60660

  • SHA1

    89c26c8a1f5b2db85e628a6526c9431e7febe5f8

  • SHA256

    bea75b57f940b13d5bfcb05a0c3ae1def9d2d25f6c3115fc7b2bf85232175672

  • SHA512

    b294fd15ac63bbd7cfd444c9df5a03c7bce8bc98d2b2d2011e5290638fba689ff083260ed60688cc4b0a0a59299dda0b1cc09ba8f63daf92efbeeaed604ebfc2

  • SSDEEP

    3072:DJFv9ssOwjRUGKXs+S++7KFSbxeY+qDDrMm:jv9cGqStKEbxI

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1