Extracted

• • Target

    tarksloader.hta

  • Size

    944B

  • MD5

    cc3c0e6f75302fb6c2d9b5e7f487efe8

  • SHA1

    aa94427fcc50b727fa22914292ea5c95755823d9

  • SHA256

    354d082858bfc5e24133854ff14bb2e89bc16e1b010b9d3372c8370d3144cdb9

  • SHA512

    24f7550776de67d94311840a68fd0f0d0041c9b2035b47899739ffbdb7c1c83281f8c3cfbf6884ad214b74f6bbb386565b4a1836e7bad1f88e661a940b8c304b

  Score

  10^/10

  discoverydropperxwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Download via BitsAdmin

    dropper

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2