Extracted

• • Target

    nerest.exe

  • Size

    61KB

  • MD5

    e2f4633e3effce36ddcbd83ea3ff7834

  • SHA1

    ee5390249a715c415a2b91450e1ff3059dcc5f0c

  • SHA256

    be5bc874511f4713385e40e7b8e1f8d57ee58ba6a25d959fa83739eaf3137d41

  • SHA512

    18afe4ad52dedd1600be8e1ce432cc80e79f6a7a472204a794986b22b12fc9831a360e73036e7a15277929d8fec0a5340dcda555a11be65223ec4965fdfa07de

  • SSDEEP

    1536:LHlznYyP4mGgRLHxDkbmakqJtF6qcDROdE8OQ8JZ:zlzvPFGgpVkbmClc1OdrOQ8JZ

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2