Extracted

• • Target

    68a3a8d3147a285c2b76e64cbb0a3bb4803aa35a35ff9fb964512ba0cec68743.exe

  • Size

    44KB

  • MD5

    122fbe0d84957e8e5fa9385c12da3d0f

  • SHA1

    ff9729798bca408c4cdbf4f44a2a25b95a7fc163

  • SHA256

    68a3a8d3147a285c2b76e64cbb0a3bb4803aa35a35ff9fb964512ba0cec68743

  • SHA512

    9ef2f06d78d5722e61ef55ceea2e19c4b12b7c0c0e95097b90ff6d98e5d2208921742fb4c31af816d20366de087775d0eb67de7b9c532f29eff54e43690672a5

  • SSDEEP

    768:GNTRmetisWt2tKdouL3ZE9R9yFRPG9Xb6OOChLsGO6Mi5:GNTketz8npE92Fw9Xb6OOCVVO9i5

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2