Extracted

• • Target
    132.exe
  • Size 34KB
  • SHA256 5be4c82003254e307c81ae221152a3b4dcd0e1ce7bdf074d71e883fad8335112
  • MD5 014bbb5a36b50cd76935f33e2c087094
  • SHA1 a59e1ab313d08ff5d1f346e0c22b22d3f9bc1cad
  • SHA512 0386a5f087901c722137c0cbe2c944e9063ab0a3a940be5e06f90cb26add14140f45b1c29491cd4f988dde4e7818b8eb5fd0283f4eb75ed96bec586840efbf12
  • SSDEEP 768:0pQnydQfegPOjPHkyAlXQFyS9Kh6WO/hOz:SQ8wOPLfFL9Kh6WO/q
  • TLSH
    T168F24B0837A14366D6FE6BB86DB3A25501B9E5039923DB4E0CD4858A7F3BBC14A423F5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2