Extracted

• • Target

    safe.exe

  • Size

    77KB

  • MD5

    098057d58885d0eedc0af8a1c8911fd8

  • SHA1

    9915e0e789e8b8447ab58fc8f292ba8d54739eb3

  • SHA256

    a7ff6baaf676ce594c6f615e4c6c3dc8b9927eece059eb90c42ff36deee92add

  • SHA512

    49aaffd1ac1d8b4254536714c7343537e308adb4bbb820ad57d0465a383f6c0ad6a9731bc06f1ae3ac39a34b383f1dc6164ae27bbb9782a9b38afe1ef96af1ea

  • SSDEEP

    1536:z6pH/9MniZZNofb6dF+b1diDUS46KOcXSbU2dS1EAd8IIp:29MniZZNub6dF+b1dqUNOcKPgEA6IIp

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2