Extracted

• • Target
    4b9fc2989203c8b8b61c5399b09f422e5493d14717068faec46cafb1fb8c43c1.bin
  • Size 186KB
  • SHA256 4b9fc2989203c8b8b61c5399b09f422e5493d14717068faec46cafb1fb8c43c1
  • MD5 33b41355afec1a2e466f2e5474e0fef9
  • SHA1 106fbe79fad0e507eb848b44d6ac564a07ab911c
  • SHA512 2053b29bcc552051972ccb6ae801195f7451f585c8f81e096dae665d818e604bbcd30ea2bb776e40c939f5614d9738915dde654985f064d23e694038a64bcb78
  • SSDEEP 3072:Nvorp8AycQ9bH85ca9KElizOuW7+gKCGEL:YCA0bAca9Km+gR
  • TLSH
    T1D614E4CB2E9542B7D3AEFA7009A3733D872BA93E7BC34E0E944B3D49173254C89415A5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2