Extracted

• • Target

    XWorm V5.6.7z

  • Size

    18.5MB

  • MD5

    ea35b74bbe3cf8de1ddbd5ab10ada9b1

  • SHA1

    6f20dd8865e84581ddfa7d4666bffeb812f2deed

  • SHA256

    7c431981e1962c71f936fc53951982071462f853f53c92dc3d4103ee5e3efe70

  • SHA512

    d9296919eec861a1e8ea72b5d590e8d6092a188208bda0f17ebb52744fbb702391022d25a51bbea041eb4db9f9d8c48ac3a0a2b14c4a5ed792c2914a7b657504

  • SSDEEP

    393216:ACEYC65G+SwHO1JoCzXq5i+dDmpu06beWxEkNgwTZDZerBjkDGp5:6YC65G1wHezB+Ypt6beWES6rBjkDGp5

  Score

  10^/10

  xwormdiscoveryransomwarerattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1