Extracted

• • Target

    XWormV1.exe

  • Size

    24.2MB

  • MD5

    bc5fc4fd462fe1ec684c0c3c3a3de207

  • SHA1

    313f3016ac5a1d33119982840720686e1fc15f8d

  • SHA256

    31953c0ae524543f4b060884679afd72809f2aaa11eeee8f65784da34743a752

  • SHA512

    31c282d8921ebf2f0934bc3d3197b9e335cb4589dcf617d75611dcd9d5b83bee6a9ed85a3a8e3407066500acc2a63d34ccbd2488a4dd1977dc8ce1d297a3fb55

  • SSDEEP

    393216:vA/nTrrqc1NTlXs515TosgE9AASto57QBLuRzEqtn9dbmM6Z1u3I2ZL4:v+nTLvXsf5TxRzWolTtn99z6ZsI254

  Score

  10^/10

  xwormexecutionrattrojanpersistence

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2