Extracted

• • Target

    injector-helper.exe

  • Size

    184KB

  • MD5

    c777067925c4275efccd6e31750b2a4d

  • SHA1

    52259a1bf97340490e0208145bb8c666e07c31f9

  • SHA256

    435011ebed0c301de1847935c54d9b80a4c279e380413d207febd895e8164e3f

  • SHA512

    0ad92779cc0073089d8c7c252eab1ff5e8ddafab9aa6a0391c41625a40a6ca46dd228bd3a36e0aaa399bd89b22e7fb09bc6bcb2f27c7e5f89b75a5798b22ce85

  • SSDEEP

    3072:P567FmwoIb5iz+bIOVMQMGxO1VjBz65/M6If+3Js+3JFkKeTno:P5im6iKbYjxBt25

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2