Extracted

• • Target

    BootstrapperNew.exe

  • Size

    3.0MB

  • MD5

    1317c60295a029805cf29016e53417d8

  • SHA1

    10b5c9538fca54ab9af9c6c8c45f09c87c165ca6

  • SHA256

    e5e2ab81f164c5b8015dcfea5442a90a11b1c9b45f5eff6b32e2c3b883368d21

  • SHA512

    c6f396c70781fbea4644edd3db7c54a6c5aa406ae5982fd1aa55e87bfc701ffd4b2aeeb4e75258326c37b97f55fd0d7d0fddde05a7b67b0399483d52bb036fee

  • SSDEEP

    49152:y3P+t/fcRNRZbAK5F6vYjUvKvThbqbi4yVkO7Wkq+POGALqPnNgDIvZ2+eT3WS5M:y/iHcPRJAK59UvKvF4CJW+mz4gkvZ2+t

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1