Extracted

• • Target
    Galaxy Swapper.exe
  • Size 91KB
  • SHA256 6016c777ced6397266b496e198e35d732321db3a35a53def0e25319650a80aa1
  • MD5 bccf186cf4241e14964f6f348ce74946
  • SHA1 f21db3bb69509a55c1e9a3b5cbf5418fa74d1cca
  • SHA512 fbca1d4748bac0f6cd3c4b7c766bf3574eab8c496d104920f5c593358e1fbeb25efd50e555e99407fca2e17ca7050d3b4615b8881a6ee1c72baef9452c2f7b19
  • SSDEEP 1536:3HrNdwLF1ajmzT5r4u/6KYBoDaRejkutO+N9bzsd7+RCt5Cp36P6+4uB0ODRIEFI:3LN+p8wyu4+uMI0j9bzsdPAYSuB0ON3G
  • TLSH
    T16A938D283BE64015F7FFBFB159E17A92CA75B2232907A65F2485038B0613EC9CD816B5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionxwormpersistenceprivilege_escalationrattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2