Extracted

• • Target
    5221f853cf61822c1e01fc25090a6599646c8430e5ad0858b405e46a3524b487.exe
  • Size 717KB
  • SHA256 5221f853cf61822c1e01fc25090a6599646c8430e5ad0858b405e46a3524b487
  • MD5 cd6fa053ba911751efa2f530ef7ad13a
  • SHA1 7c522d891eb1f468464e8bbbe9d3a57afa8800b4
  • SHA512 a244b75461de959bba9dc15e1c7c41917c9bf30ad8ed4a9a121ae7f0f52168503496a77f5ef072b0eafea0fcade242acca948fec101705ce5312fc26f0e9d2e5
  • SSDEEP 12288:PlJdbnZ5uWIOAunM1ckpvt4vwH4CilII5sUUsGbm74kLziak94/PU:PhZ5XDAGAvevwH4CilIbUxkm74tJ6
  • TLSH
    T1BDF41259AA85DA07C15213345A66F37822BC2DE9EC00D7239FDE9DFFBA36E148D041C6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2