Extracted

• • Target

    Solara.exe

  • Size

    44KB

  • MD5

    2d77b2cc88d69fbae3a3b7d5f89e1de2

  • SHA1

    09cf5e15b06a5b962247b45807594808a66e38c8

  • SHA256

    2208d8cec15b9f5cb0d2633a9fa0761120a6432927b1401c0683df982f00205a

  • SHA512

    f890a7a0c009a2edab6c134b51e813a97697193c3a4c47de3f8a4eb2c635444cf178f0f36b7343db79d54dd95d449bbec63957e83c40b83af2d75168f6863aac

  • SSDEEP

    768:qNTRmetisWt2tKdouL3ZE9R9yFRPG9XZVkw6OOChDsGO6Mi1:qNTketz8npE92Fw9Xvkw6OOCdVO9i1

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1