Extracted

• • Target

    BootstrapperNeww.exe

  • Size

    2.9MB

  • MD5

    1b1b8584e5ef883aaa5be59076087d6b

  • SHA1

    e2067cedc5a022487fdcd4f7407b75202d6b0eb1

  • SHA256

    c0361ce0281736d7c36d465ba67683cc16d70335186bd179cedc8f0383760ae4

  • SHA512

    73a951370df807595ddb61ab81aa7e5d7407fca5dba08f40e209d48e1bc2e4e4960439fa61bdf8a2967cde1865460c1df025fff6124607f6eb0752f35e382d45

  • SSDEEP

    49152:IlcyXfHnaBTof9ePCjkIAm1skqXfd+/9A9ByClY1v/a/ehH7pNLLn2tM:CZXfHaFoCIvqkqXf0FglY1XOe97vLnh

  Score

  10^/10

  xwormdiscoveryexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2