Extracted

• • Target

    Solara.exe

  • Size

    39KB

  • MD5

    6857da68ff8f6f4d2a5ccf084a986cd8

  • SHA1

    c77e9eb10f80f0af86e5b1fb58e383fcb7c9127b

  • SHA256

    d2347ef2b7dcc437febfc6d5716072dcd9faeda6afaf70f4795454c3da6d1240

  • SHA512

    3aca870813c74669ed358e39272136279f48f04c101617653c4309055b97d958e792df0dfdaa34f82f6552fa73a8705e7750c93ad5f8965956851e6878ab989c

  • SSDEEP

    768:t4SnFmvYC9ehSPthRctwzoFd9waOphwjtYir:tT5gehSjOFd9waOpYhr

  Score

  10^/10

  xwormpersistencerattrojandiscovery

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2