Extracted

• • Target

    Solara.exe

  • Size

    44KB

  • MD5

    1150929a02621ff0d0be6733e29384b9

  • SHA1

    492a4b13def38b1b62c41450a3b885a18c979c52

  • SHA256

    6d7a1d6a51fcb0bf6ef1068a108f53b492337f63cad4555d706e835da63519a9

  • SHA512

    a98cb8995b4634e9d8fb636be85715aac9012b9809f8fb294900e3380660379575ab33c4d01b79ddf9508afa6e03847bdf26b242dbb45bcc6cd79c49486b3639

  • SSDEEP

    768:ohMJ+n2DNw1N1QbEblsUUdvFFRPG9+h2P/6OOChEvmbWT:QMUn2uBEbvFw9+8/6OOC+uiT

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2