Extracted

• • Target

    SolaraX.exe

  • Size

    75KB

  • MD5

    bb4297c0a1be56440bc497fb1c276a82

  • SHA1

    71db449f4de9b90906866b830ebdabc12c518c20

  • SHA256

    7df7abdaaabc41cc080678e71723d5a3ef855abe8c154b87e39664640c8be48c

  • SHA512

    a534e7f9107f226d127e0bc8472bb6d35c1eccfd38096ac13f1fb6aef885e52358e6766a604c735a50b0d8f2bb8c9b9bdf1f3e0fa418ccaed5eadadc504deab2

  • SSDEEP

    1536:2MuQthAcx9+rFQCb9Hi/bWPUtb/UVbV6foaOirUpPyUS:7L9+rh0/bWPBVUROirUw3

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2