Extracted

• • Target

    X64 v1.4.exe

  • Size

    76KB

  • MD5

    1a6ce13e6ca5801d773725074d8127a6

  • SHA1

    abc2d87c256950524ea6bc06466b7ad63dec042f

  • SHA256

    0cea3395a719813d0a1bab5a21ded480f70b6da0cff2b8ff632a0d42bee303fe

  • SHA512

    461708a2a62701c4af06d54e0c86fa5380c12a464a1e208c539f7835f4c5b0f3d4064377674759e0f9b237971b9414f9c39acf9da455aabacdb8ca2ea1018d10

  • SSDEEP

    1536:F01NQngfiQr1jx9/9EBeJKYamex+3tDUUGcDl3nIAd7CK8byIMn:y1KgF/9+FYajk3tDUUGCBIa7CK8by1

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  behavioral1