Extracted

• • Target
    7fda10c7c950f427e2d65b67e519e87c90a852c86068751b8fb22268733de2b0.bin
  • Size 36KB
  • SHA256 7fda10c7c950f427e2d65b67e519e87c90a852c86068751b8fb22268733de2b0
  • MD5 8b86b36be1c9eabe440933a40aeb437c
  • SHA1 9396e2c50b13f15f52547a3b3cf33389a7234292
  • SHA512 681ff806cdb673bced957e10587d20f16756ff1ecdf07374ae8367355846610a5b9aa9dd75f66302d14619259b4adf83fad24caad22604387e56244316195ea2
  • SSDEEP 768:UTlBb44p0v9zfflPRX6T6y+xyW5Fyw9/Ul6KO/hTyg:UJBiRxRWsyAFr9/A6KO/1V
  • TLSH
    T128F25C4877914325D6FDAFF42AB3B2020678B6079917EB5E0CD8899A2F337C585113E7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  behavioral1behavioral2