Extracted

• • Target
    a7462aee88fd1a2fa23b627c2c42de9c.exe
  • Size 80KB
  • SHA256 496d7e66ce98f06cab49eba51616c85558556a34682d87c824fd52e6a764a2a4
  • MD5 a7462aee88fd1a2fa23b627c2c42de9c
  • SHA1 f90050af941e6371263d199c6d270acf85213900
  • SHA512 83cf59d0e56b6b77ef9931e7a2b1cf8c382877f06b7d7cec4145923f9985c5cec556d0d6d754762fa79577efc7d55026aab313bca13f9e09048b18ff24641548
  • SSDEEP 1536:8IPNkhmX3KDEfsMA0Zkbo2gC2gg6XkCOYpdbBT:3GUKYEMRkboCOYp9R
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xwormdefense_evasionexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Modifies trusted root certificate store through registry

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1