Extracted

Extracted

• • Target

    xworm.7z

  • Size

    18.5MB

  • MD5

    cceec836b15bfab2ce08828642145c32

  • SHA1

    86742f0bbd6e29d4e62ca988c397093dc8d7a3f0

  • SHA256

    9e0c79e062d3fc16c0c1599df4e8ae73dfe1fac6191766047831e7c3fcb6cf6b

  • SHA512

    de44c7f423c27cbbcaedcddd0faf5b483e8337ade9e0f930e6c0ddbb174cd641bbb13ac5d762e025a701a6dc4fc768ed737d461a4ab5296d54f1c9dc2480f441

  • SSDEEP

    393216:FqKeYOG5obypgrFXNDVE4cnsF/v3J3UaAi+ok2D4evUgKRGUG:FqVYOR2pgbD+4aQ3Ny8D7sgKRtG

  Score

  10^/10

  xwormdiscoverypersistenceprivilege_escalationrattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  behavioral1behavioral2