Extracted

• • Target

    ILOADER.exe

  • Size

    102KB

  • MD5

    f3071053a4a5b7c6116390e2d4aed29d

  • SHA1

    5056680a6e64137d31edfcd8a163225c642badc9

  • SHA256

    a52967cd57ab936447fb9d631ea2c1caa904aa37b698ac18919d57e42017df55

  • SHA512

    db7398671f2c9e49d81691edb7157f6dc98eea14e9034bbbf86a21a1ad190d4b3a04a6a640979dc3e7535e9ca4c62a68aa4df0c9d6c3f78c59724842eceb1f0d

  • SSDEEP

    3072:H3/zbgow3dlSHbG+btjnOBQnC3GDNdZwCxaOKFmh5:H3/vgZsPbpCKGLMh

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence
  behavioral1behavioral2behavioral3behavioral4