Extracted

• • Target

    NewLauncher-1.8.1-windows-x64.exe

  • Size

    94.2MB

  • MD5

    cb61d84f1c390ff8877192d46418e5d0

  • SHA1

    51564c4ce8839d3745fac45ff731881909686ded

  • SHA256

    0e25cd68fc4069e9c927544e5ba8a1e0af7df0ba8f5d2c39f3d39d0a1991ccc5

  • SHA512

    ae7d0df4da0435c92bb40a1b27722cb617998539a449d4d7ef3f81feb1649113291a2a2ad21b3b94a546d028c76f22b6c6d04572966af360340b5cc1d80bf587

  • SSDEEP

    1572864:LxM/ESr8BdaxPULW273LbIVLoCd+efYwCPjpHsBD12xYGd0eHQ6SIlZ9X4ubw9xN:VPBRLW2L2L53Yvps0xY9eHYIriubw9xN

  Score

  10^/10

  xwormdiscoveryexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Enumerates processes with tasklist

    discovery
  behavioral1