Extracted

• • Target
    ion‮gnp‮gpj..Scr
  • Size 440KB
  • SHA256 aae197391ddb79b9e81d8f92712bf4d7d4c76a8b934673cc082c2af42eee936c
  • MD5 178b5ec485b48bc08acf1102ad7299a4
  • SHA1 38d35a5ff292f326ad508309688a6ae4b73872cf
  • SHA512 19882dbbb357ee7e0a6fce1aa14b86694769302c762f2a0b45bdb072e9fa1606b690cad8f4475a0d80a5249af91e7b8a26c2b68148ef71271e598221c6a2c6ca
  • SSDEEP 12288:TDStU+xRITp4bX4pJZ47GT75znhMGn3EX3:TF+xRXbX4pj5pzhMs343
  • TLSH
    T119A4F104B7ABC72BC79F0B3415F294FD7176ADDA8713974A0AD1F25B6A0A3D08903672
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2