Extracted

• • Target

    SolaraX.exe

  • Size

    64KB

  • MD5

    20e42cffe82f2c2a81a6dce44b4c0818

  • SHA1

    bbf771622c0b3a330030ed48657d10c305bb758d

  • SHA256

    38b88b1fb8c91f62945e62f56a70d7daf7b1a8324f557421bc2414c11f0cd5fb

  • SHA512

    b72ffff10c183591f6ec535162d5db1abf8eec02722da7d0229c83fd95e4606c1944d32b32aa82cac73d046c9ff70134df04c202b99dcb2bae53c1c7844c88f7

  • SSDEEP

    768:EUqmY0eYr0we/TYUUfBGuMCSarWdrVz9W+bO5DxjFA6sfcTxgOqhQPejExz:EGsMUuBGA1os+bO5NBA6tgOqWPkUz

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1