Extracted

• • Target

    FATALITYCRACK.exe

  • Size

    73KB

  • MD5

    e9dabe76c237b83a5ff65c5c6a91fd76

  • SHA1

    0bfe154332e8dee0701663e91f94380a925ca5f5

  • SHA256

    37a555ac27b1ad7f51fa11981105d62f10a62295a67bfcb4ded124ba80e5a074

  • SHA512

    62b79ce872c2b620be61e92c91277b5ec82d4da4a9851b7696f44531037c3a198e861eb87380abbaa4fea07b07a8b7d362028da3a2bea882bee287cd98699cfa

  • SSDEEP

    1536:2/Ri4+t+rR7WOERib++bOeErInchPqZQ6L5iRHOKiAjWb9hC:2GrOEUb++bA8iqZHQOKigMzC

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2