Extracted

• • Target
    35f6b5905b4995c50de76e54a05e644e9d384ec0101e7160685d57df9e831584.exe
  • Size 845KB
  • SHA256 35f6b5905b4995c50de76e54a05e644e9d384ec0101e7160685d57df9e831584
  • MD5 91fc08ed9f40f9206b717a3eb363b49a
  • SHA1 9e7dc5d33c559c1d1d12c174109ca478b22824e6
  • SHA512 1c0536f0486b311fad1e29de5b7d4f25f829fcdb3eae1f4465b48e332f3a3d1eddbade8e657fad4477c631b633a86b4def5ab7de6a0a88607463bc4da31225ad
  • SSDEEP 24576:YZLojmAEFT0DREGJXg3D12bbE8aaqQHHs6FGs+a58wDLz:YZL/3FQmGJQ3xKbHam1cfdwD
  • TLSH
    T16D05F1553359DD02D8A64FF05D60E2B41B745E98E822E6139FEABEEF78BB3101C05386
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Suspicious use of SetThreadContext

  behavioral1behavioral2