Extracted

• • Target

    ISTHG Launcher Fixer.exe

  • Size

    80.7MB

  • MD5

    36d7b5f683034cb80736471dd06ac521

  • SHA1

    36107f679d0b647d660d151204ed3bcefa4e3bff

  • SHA256

    322ade330c1d135d9a602323523d8d9198bfd60186666bc7b4169d39fce9cf53

  • SHA512

    00f2dfb80960559a21284173dbeb6d21b2c7999e987f47216cdc2629cedb412b747313d7b3dcddbd4644dc777db01db92fc4174540f9080513264749577bbb4d

  • SSDEEP

    1572864:kww/CZRSyW/nc6oOxbbX7++KqmLjrLISInYndP/MgAWvc01pf79R:VGCTSVkHQnX7llSGYndHMgLvxpf

  Score

  10^/10

  xwormdiscoveryexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Enumerates processes with tasklist

    discovery
  behavioral1