Extracted

• • Target
    5556asion.exe
  • Size 31.9MB
  • SHA256 c9be731ea5b05f8fda23f6c5344d53de5c44b644bfc4a507b29ce8a859ffbfd0
  • MD5 3fc44a783830cc0f2e502b227f2f923f
  • SHA1 d4279305327737d28de3b8bcb4913e912cc75cfa
  • SHA512 b9def4f558ae7c0096c80ff6ac99a7c47cf3ec5fcf8f12ceff1b5923b580b8c8909cea6bc6e211cd1ac756468490895b8187846f895d7e476535309a71d6901d
  • SSDEEP 786432:Coa73Tye/ea2wIMEDq/k+bY758KPYRphqBo+Avqz3tevF7:5e1/ea2wGDq/dbAdQPhBiz3I
  • TLSH
    T10A773328EFC255BAF4EA413473A88E12E27234812F64F6BF0BB0169B5E1B5D04E751F5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • UAC bypass

    defense_evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Stops running service(s)

    defense_evasionexecution

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1