Extracted

• • Target

    Fatality.exe

  • Size

    81KB

  • MD5

    dc67482444de267dc23899e2d6357df9

  • SHA1

    39ae255257f1fe33e05a36caf501e46e5b9a8f74

  • SHA256

    95a65f9c396cf5b2deb009a0d449ee474d74bcdad088631f87ef04a123583bda

  • SHA512

    a2a6f413958f1e850756b18e7d2645e4b34af8b90986906a920c4451d0158f5667fa0e61e975aaff4f66aa2f669ad569a6272628e92521e57c1cc2d8835ed90a

  • SSDEEP

    1536:nTcmz333uUwKM435R4NboW6T39h+b12VAcI9a45dgFZ8WC86U8OHUzicK:fD33m65+UWg+b0VQX5dgFeWC1O0GF

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2