Extracted

• • Target
    54db77d001f909ea7ce02ce14bcffd5f903d7a7a571d409b5b2a4316575f730c.bin
  • Size 65KB
  • SHA256 54db77d001f909ea7ce02ce14bcffd5f903d7a7a571d409b5b2a4316575f730c
  • MD5 b2a13f0d62c70cc252f291be7abd7ad4
  • SHA1 441b11bb2e4ccd1b3ad5ffc0606164c793ea42a5
  • SHA512 05981cbd2982281f70bb91a48920c598da8aa6622ae765649c32aaa9286262f0a1728355e39b59729a6b2e3f283b344ba04ea8a80cdc0def633d31198d30b720
  • SSDEEP 1536:V+6/3YrEi5M2gkbOXapo5q3UDmo6YnDFKO7yCGUHFp:8i3YrEii2gkbO+UDmGn5KO7NHFp
  • TLSH
    T12E535D287BE64015F1BFAFB11EF57253D67AF72319029A5F14C9028B1623A84CD817F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  behavioral1behavioral2