Extracted

• • Target

    Solara.exe

  • Size

    44KB

  • MD5

    cb5aa995d9843fd0f787743a2a860dec

  • SHA1

    ff1de916764d817ed1ac6dd036d5b02f1810d016

  • SHA256

    f82ebddace7d6290ddbd12051aa19e3cd1355762196936f686e26dd5e5c47b60

  • SHA512

    8c5500738e06c6701c29019a5d6bb391ae1c1e9fccbbceed0d6c44669a35450074052540ee40a100df0b9c0cc4273d618f6151c094a00538f6583f3969f03529

  • SSDEEP

    768:BFM3oVOl50FADMe/e2TJblsUUdvFFRPG9+l56OOChwvmbWp:vMK650osOevFw9+76OOC+uip

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1