Extracted

• • Target

    Bootstrapper_v2.3.exe

  • Size

    3.0MB

  • MD5

    7744ab1b77f1c5204aacbcc67f80f5bc

  • SHA1

    a1af80b9ca1310167c4f8e772c3959fdf4167f32

  • SHA256

    3d418b43b753aa207aa32e87d3aac20cb5cb1498852a3d2c310196c7d668fb80

  • SHA512

    6760ad3682c7a5eae25c7ec934a0131b13e02f621d4ed4580300aab4659a4601afbcdfe1ada11155a8085be6b0759c38aa810587559a074d4d61ec281566771c

  • SSDEEP

    49152:VmjfxLrv43xqsknxiEgcbMSYKlUgmFLH7G7g569awPsD9sOBfXVfRQ8kQ79u:Vedrg3xTkx3rUNG7a69vPsS6/VfRbksU

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2