Extracted

• • Target

    ExodusInject.exe

  • Size

    227KB

  • MD5

    38b7704d2b199559ada166401f1d51c1

  • SHA1

    3376eec35cd4616ba8127b976a8667e7a0aac87d

  • SHA256

    153825af8babb75361f4af359bfdd5e95cbdc7f263db5c4e70ac1da8f36bc564

  • SHA512

    07b828073c8f80c5498501c8f64decb5effa702c8bc3d60a2f7d5de36d493b469cbbf413fb0c92c0aadd6ee139bfb75f3b9e936230212d42e57d2ec5671e9b27

  • SSDEEP

    3072:iBIVzZQgudhV3mypQgbNjcEHBAnpK37nXY8q004Q78ePsi74tyJhbgKL/VoilIBS:Ur3mypQX8mOeP/9/VtLGH+8l

  Score

  10^/10

  xwormexecutionrattrojandiscovery

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops startup file

  • Executes dropped EXE

  behavioral1behavioral2behavioral3behavioral4behavioral5