Extracted

• • Target

    downloader.exe

  • Size

    31.9MB

  • MD5

    464e7b0867fbec43a23720c6a59bdcb0

  • SHA1

    0bb452c8cc6957ac20c9aebd84f3d2051ed793a6

  • SHA256

    743f0ee62fad69d3b50b237c6a1b5aea0a3f962bf8c0f586b43a9e5709e8752e

  • SHA512

    1963d3aa3fa3d35e8e07f15d4abcae36113f6e280be6bcfd1af4e1020434107ce9a4da77c668132f1064335290ae6876b0110013b22dd45bb0f44b28e8ff7e5a

  • SSDEEP

    393216:WF0TihrqK9QvSqbOsZXMXbQ4UflU8AR4h9iBTa9UIWWzTSDCcL2F5aAU:WqgODXm8EVQtWVDCcqbU

  Score

  10^/10

  xwormdiscoveryexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2