Extracted

• • Target

    305a039e946b1940b70a70da8a01708263ed8cfa5f68252bd6cff1fde16eaa33

  • Size

    199KB

  • MD5

    cc6a07e8eb3c8dea437966454382bcf8

  • SHA1

    3bc8c0e5dff8562047bc05aea555c35f7e47d9b1

  • SHA256

    305a039e946b1940b70a70da8a01708263ed8cfa5f68252bd6cff1fde16eaa33

  • SHA512

    cb7864f782c157c1d35c0403f06469800922ef626dae9493136215e535e3cbb3cca640110e93ee674719b47770456c7dbb1f0cc2daf13a7bc58ea9b676ee1038

  • SSDEEP

    3072:OF71uyVqkbwzBYOw5TJBlFYmHl5rbxBo:Oh19VxbwS9vYmFT

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2