Extracted

• • Target
    SecuriteInfo.com.Win32.MalwareX-gen.19961.13774.exe
  • Size 495KB
  • SHA256 f8e5a47c68fac52c69ec3fd461cde2ff76d64fda08c528c066a0ab822485cd23
  • MD5 a8a513025c62e475dd1b41989968876c
  • SHA1 20b14cfcc1b6959599a0684e2d70c4a02f0c18e3
  • SHA512 3a2c81f7612f39080342391d7a7aa21595a3d8ce03918280bc5dcc6f1d8eb69e17195a1a596856f17a5830c29383b7c824e214e10b395ba659adfd16a0f78c94
  • SSDEEP 12288:zZ9/n9k8ePW38ON1XU0aqgiDOKW51+WrMv0Uxj8V:Nw5W3fjaqgiN8rU0UI
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xwormdiscoveryexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2