Extracted

• • Target

    Xy.exe

  • Size

    279KB

  • MD5

    26b8c8447ad993bac09e6f270c971350

  • SHA1

    79eb2edfb98048ff5a1c299bd3a6791fd50f5c28

  • SHA256

    fd9e202bbc06743763e464da73aad4904e2f4840ce1ec716ebd65df8145807b9

  • SHA512

    1b67eaa1efda4a9149a29047e8a996e13d10e1d6e73f6d496075733b647a36718ac14fc0fa3de22eb1b2e66093470df18f9fae81a1f48427550633b93082834b

  • SSDEEP

    6144:5s8L+T9Gs8uhFJuri3S6leB4eYdEQXj3PFCITdBh5SU8S9S6VeDk9:5s8aGpIMiP3SkjfFCABhoDS9S6VeDk9

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1