Extracted

• • Target

    BootstrapperNew.exe

  • Size

    3.0MB

  • MD5

    bff87092bbbb8b265f9109351bb705b4

  • SHA1

    f77384b9700f4899eb9b6e973a3f67258b8b38a1

  • SHA256

    746c77a58163dd078211c86687ae3a7d8b3af1cb948983a8f4f7ce2167d22dad

  • SHA512

    04acf2774bc60acfb7506e32925acd33c1f9fffd4e0f903858172ab9c892203489a98874ef441f6cc70053f51bc737d9dd719d0b5f72e9e8f43c40b1d223ec0e

  • SSDEEP

    49152:OQJmPAp/HK6UBdnBwpirpcWBpfk2nQdHQrAVbJ432MuMd2jPEa:1mG/HKBBNfco8qisAw3gMYj

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1