Extracted

• • Target

    48b240ba8fee82254c60726c3635e121e5c84817d74e8c65e88f90f97c71ec60

  • Size

    90KB

  • MD5

    8315e117fc6a50d1c842af2c6503766d

  • SHA1

    b2bfed39edf59185127b83d6b0c27fcb083240c6

  • SHA256

    48b240ba8fee82254c60726c3635e121e5c84817d74e8c65e88f90f97c71ec60

  • SHA512

    9b1fa8ac3008158c38f4bf5602ee379fc1db8a2ce48b2157433713050d620fac49fcc5e34f12917942f7b509bf368fefc39d88d3974fdb44c7b180a7751f1c06

  • SSDEEP

    1536:z0P9tIviJ6fofHXNz8EwD+pD2sWeLqmXygpE+9bPFdDgmTRQz6upWgOS8Hxs8v1:zWYAfdEapDRqmZ79bPF5hNQxp5ODRse

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2