Extracted

• • Target

    Nursultan Alpha (prem).exe

  • Size

    3.6MB

  • MD5

    9da7ae2451efded063b29e9763aa244c

  • SHA1

    fb8ca87e4858331ea25485312a5d71ba25704cbc

  • SHA256

    a993be0a000fc4fff5b3806da4d35981551c2ed13655a19985e2f1928f869e07

  • SHA512

    370af95e2ef727f05051738d9f878e9b3954f9a95e2d486afc1000bb2619f9105c1078ecfda78e73cc609e87799c7e67bd19afdd1d1a9ea5b781b896f8825c66

  • SSDEEP

    98304:7u7xU6HERA18WXVP46ir0HKNDKx8/0hYC3srW5cXVR:7u7i6HctF6g0HKND0

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1