Extracted

• • Target

    loader.exe

  • Size

    64.4MB

  • MD5

    8d2648418bae33657c018bba48986552

  • SHA1

    ba8b6fd3bd2ef772e5f3a0db7f40ce73a916fc3e

  • SHA256

    80d76f13907f3910ff9db3c107eff209aaf0a4d2e782e795e5a0e95ec7df09be

  • SHA512

    a27ae27487660d797c1e2d24632abeb3eedfff66ee260ba6bb3313e8f660b371838e56207268961cb34f725295b485507e35ab1331963add70be2c3b7c547e70

  • SSDEEP

    393216:RjaZgP8kqfoo53we9r9OJ/sbA9ZhGInxtnWxvdiQ2OUNpCEp7kN3VkQGQPNLFu48:pkghqfk49Otsbyx1DOUNoER7gq

  Score

  10^/10

  executionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2