Extracted

• • Target

    SolaraCheats.exe

  • Size

    43KB

  • MD5

    d3ff8047aca44c123aee05f1b70461de

  • SHA1

    32103819ba9a8147321492701539b024c475f3e9

  • SHA256

    4bb7d508bf673c704a2e32e0a377cb22dca7bcce49926c70e1a31b0c49a3799c

  • SHA512

    a951d7e84ab2ad049de3c28faae48fb2797fdd71b038b4520db3139972ad5af489e62de648ce93d16e4bc8dfd228b281f4fe672ccf4bcd6d301ab10299d3a925

  • SSDEEP

    768:Ypv/mHz9gP9C6Mt7ZDIeEb/chpbTW/gjSoqqa2K1zs1Qk2GmgNjPYfh6hb:av+cC6YbEYLnJSod41uBYy

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2