Extracted

• • Target

    SvdvD2oMxskKpFA.exe

  • Size

    2.8MB

  • MD5

    37449ec900f5315bd22abe4e4d8861ad

  • SHA1

    584d45cfeb259c3b89cb7ed0734f0334f2432d59

  • SHA256

    e737aeca763418b072714874598a77466634cc2f8d1133c5ca57ad0feae8ffb5

  • SHA512

    41b857432e067b9f9f6e63c6b70c1d5d2388f2b7d40b8053ed3dcdc4b156fba1b0cdef62593b30e38fa542fe5514d129e2a614cc21833bd895dc73602c30684f

  • SSDEEP

    24576:G5tXUp5hTtlRfyhaaJRjbEHi0zScrqkx03XssHftjQVM+PJxbHXDPvP/wYUIgH1b:Q3JtgecJ03X/x+M+rfwYUIgVY7vD

  Score

  10^/10

  xwormdiscoveryexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1