Extracted

• • Target
    428e478e4fd72979677f7fc4f568a2fd05a811cb3ff555a4bd068226e86b012f.exe
  • Size 809KB
  • SHA256 428e478e4fd72979677f7fc4f568a2fd05a811cb3ff555a4bd068226e86b012f
  • MD5 8284465df87cda31b4bca24429fc15c0
  • SHA1 b0fca726c690270381f9f48acc0ffe36cc762a9e
  • SHA512 6f3d8d8d1118209aea157898bdbf337aa9946cee4a510b4a19f16826783adb0c7b91246a3ed9254d0c1aa54224ebc683fc965df77f875d54660875ebb8ffd718
  • SSDEEP 12288:ko0/fJ6L9FOdMp+0ZO+l8fHJZnPwX9iB1gcHwxo0ROQ5n5hstWCJ3t479KFhVgUV:kFR6pF3l8fpZn4X8/gcQewdCn6W
  • TLSH
    T1D8050288335BCC02C5A25FF01EB0D7B4157D4D95A811E313DEFABDABB4BE29A6C85181
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryevasionexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2