Extracted

• • Target

    ed83e0889ed251a46197ea2877dc74957a67551f746d64cda4dbd870b883db1d.exe

  • Size

    69KB

  • MD5

    5d37e31fe1b07076f070f06d7a2cf9fb

  • SHA1

    b0731819832701056f1799ee1f52a222fcb93b65

  • SHA256

    ed83e0889ed251a46197ea2877dc74957a67551f746d64cda4dbd870b883db1d

  • SHA512

    fc7313180542fa84e0e3727f8692a42c4e2e2e10586dc7bd918dbe40450cb525e1b1e3e2043a745da7d5bee60310edcf817a889de38eeae4f815588083dd2d5d

  • SSDEEP

    1536:EZjRQtLD7nNd0K1Pz3NmG6kF+b1Wm7bc6JOyTjfhk:GWLD7TPb4G6kF+b1Z7jOyXfhk

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2