Extracted

• • Target
    0415f6e7ca98c19c76b65c72d61cb72a3594f679843ad50f7d292528ef2b6483.bin
  • Size 38KB
  • SHA256 0415f6e7ca98c19c76b65c72d61cb72a3594f679843ad50f7d292528ef2b6483
  • MD5 8cb7f60644e9ce30ff8cfe286fe33688
  • SHA1 12b6cf61688eb497c27944bba2c57efbb2bf441c
  • SHA512 339736facad93f05aaa45833fd8c9be80bd1f7c04bbcbf7a0f98768581ff5d23b5d10b5704781a6ec00aa32a5e95f8575d44292d685174c06bfb2d337af1b4a3
  • SSDEEP 768:3XYwB+ntECWbLG1KuuuEIRgefFWPC9336cOMhWam:HYuW+3O1KuuP+FJ9336cOMYv
  • TLSH
    T11E035D487BD44225C5FEBFFA5AB3A2060730F6039913D75E4CD8999A1B37BC84A413E6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  behavioral1behavioral2