Extracted

• • Target

    FiveM.exe

  • Size

    84KB

  • MD5

    57e96e0ce3dc4da16e34dfb76debc0f8

  • SHA1

    d066d341c0ea9b0482b4922f7c7f5e31d2f7e355

  • SHA256

    85095e2b1f2d6d56ba777e2251c7fb90e64436466292b069e6d4e607e52ab934

  • SHA512

    9f99cf47cf34f65ec9ee142ce30e391bc687ac869d8b620995786bcdbfee0d6914e6cdf3d0f8910570f6e2b2a8b0fb8f08c901dcdbc2a23c72148142d6d7d701

  • SSDEEP

    1536:aPhpoW07foseX619wFUEMmAubTNVNRryb/N3694Osd/Sq11M7xIkLK:a5poRzoGI5AubjCx/OsZSq1K7xlLK

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2