Extracted

• • Target
    XWormClient12121.exe
  • Size 35KB
  • SHA256 b4c7b011a4511bc095c3477a5fe4cf49b230aaec0af44947aa403fe4d17d783d
  • MD5 9513af9f6594f7516e8b1a33c23eec53
  • SHA1 9d2dd5454a627995eee0b5389a71c8e38b68d803
  • SHA512 f9ea932bc95615a003fd8170130427beaf62b2f95ddc48f51473a81665fb1fbf53335fd45caf1a195450f0959dfa2e61a6688514edb6e309a8994334e19853ae
  • SSDEEP 768:3DjTfUhFUK+L0SIMgJIAJ5FyQ9v06pOjh2yp/:3DjTfUhF9+LdIMguWFh9v06pOjIM
  • TLSH
    T1A4F25C08B7900226D9FDAFF16AB3A6060134E607DA17EB5E4CE485DF6727AC08D517A3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2