Extracted

• • Target

    SolaraX.exe

  • Size

    80KB

  • MD5

    d80d50b89892b3e8c3114fe4044df4c1

  • SHA1

    c2853b4e989f698148fe09c317895d5da073bdf3

  • SHA256

    30baa00474cb42d9587213111d41fe3aa906684c636a6df02de95dcbd89921d6

  • SHA512

    3a25e6b9bf6f792dd25ed0d3da81504d5b2963ac060fbc62bee1767d6d760105649f5f3e7d357fa14c140d1eb716712e83a190cee489cf70edc71d31ce8855d1

  • SSDEEP

    1536:GaapelDMF79xxpx+d+bJ6813qTBOv4O6PzO+EXPNUE:kYSRLxpEd+bJaBOMzO+EVp

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1