Extracted

• • Target

    injector.exe

  • Size

    9.7MB

  • MD5

    86a51d640ea68877541d015596110871

  • SHA1

    9ba1687ba37d28db708b9a458350b646f7f6d1ec

  • SHA256

    fde50f0142a28aa4729653fd6d20fe24444b4de78db287e6257377e617d4ffeb

  • SHA512

    78184bf183807df518449ed5a6e38c3668c645bd9fa22cc9c2adb8786e1a5eb435e43ab5c551b998947ea76f03499c599e9428d7f6ccbb72a912f356b884d8b8

  • SSDEEP

    196608:q9Fi1rHBpQ8du9iLK8KyUmydMdRqg3fDsu4/f8QeN:nhndhPPqWboi

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2