Extracted

Extracted

• • Target
    NOVEMBER-ITXTIRY-2025 .PNG
  • Size 511KB
  • SHA256 86a0e60b71deab147b895b61c74b7d1072737782b03a742c9b4d3e22875717bd
  • MD5 2844ebe26b49bb2a6ebe79b4b1feb783
  • SHA1 0b79922b04f56d4dc6afab046328165eb0fd8f2c
  • SHA512 3a6489c3960eb3d4df9427a5955ebba38e89db163e16d53ca5b4881bf16b52ab42b640da2aaa851295bd7d8a034ae1245a4e54aa9474e220fc41176da73231c5
  • SSDEEP 12288:zk1QytxsVCBeGbb7+0fvFjILdZqxm3Ol1Q:zk1QwhBeKu0tILp21Q
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutionlatentbotxwormpersistencerattrojan

  • Detect Xworm Payload

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2