Extracted

• • Target
    5ad1c313fb83b8e37cfbc23a36e6595386fc4cc53f3af6f098646af90cca6700.bin
  • Size 38KB
  • SHA256 5ad1c313fb83b8e37cfbc23a36e6595386fc4cc53f3af6f098646af90cca6700
  • MD5 9649d9a74a60159314a0e88767785ae5
  • SHA1 2dc871c1dcd1f16689424f2f20c02395c94dc093
  • SHA512 08d5350b647ad0795f724093d500ad286fcfc2deaf676b4973eb783c98f91b2b3b7c0cb92d08043aca8a2f3d4a731c6ed1143d117b56d15ae60418c20331ab46
  • SSDEEP 768:phjMrIAvRP2vttTvWwtdQU0uusifFWP/9YY6TOMhEic+:phQrXuvHbDtJ0uu9Fg9YY6TOMCW
  • TLSH
    T1D4036D447B944225D9FD7FF169B366060770E7079D23EB4E4CD8869A2B67AC0CB403E6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2