Extracted

• • Target
    Roblox Hile Sınırsız Robux.rar
  • Size 18KB
  • SHA256 935f8aedfff4eaa00c1c91355691cb54f78853d658619e3fd6977d113650bb3f
  • MD5 f29c86722ef53f2dc0e075f5943965ea
  • SHA1 9d434dfe22776e526349be320fdd9af2a7c326d4
  • SHA512 e60d923e66d4607809a1cf609bf9370b9f2c797c3c7e23d66c053e9a9ea2c22b63b45b8e71c75a67fd93c30fbd58954d6ed080d42ce648643a4b18fd1cd8d24e
  • SSDEEP 384:IFr7qtev3Bi9MPvz25ReHLIldDm37C0YFxDQbUSS28uhovg:INGtevRi2vz25RerIldC37C+bs23ovg
  • TLSH
    T18D82E0961F59EA04BB9B8B3B4DC77D46500A894A3D7630C8C42C96CA9C37C13A3DBF52
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2