Extracted

• • Target

    vaJBMLa9PX3g4P8.exe

  • Size

    86KB

  • MD5

    52b32b4d4e7f2b918eceda96cb755e41

  • SHA1

    efc17704ec1e32f4228c7ba030b70ba2b5113837

  • SHA256

    2c99b1f642afde5a77d480ce56dd3f9c3e3d248004557fde144f28d75cc96595

  • SHA512

    8ebc502e2a6ddd5d050bc7c5350ec51f07576c2c6a31b5f82b87c3e3d979ff3ba090006eeb0a8dbc531bc66ea8968152af8e40cb938790124b8bb39ae2b39cc4

  • SSDEEP

    1536:e38SRAo+1qDQHBoJBng+foNW2hLUAjYeHEqIALZiAg4b8jBTjD:e38SRR+oiong+ANWUz+HAg4glTf

  Score

  10^/10

  xwormdiscoveryexecutionpersistencerattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2