Extracted

• • Target
    37f7127bcae8388c61432dc2d46b0df36cb33690ebbc5b725b28b33dfb145d4b.exe
  • Size 833KB
  • SHA256 37f7127bcae8388c61432dc2d46b0df36cb33690ebbc5b725b28b33dfb145d4b
  • MD5 5053320a66a5c4989c44a932a8720b7d
  • SHA1 f63c54193c17199031d7826b5ad0660db4ffb6e5
  • SHA512 b04be55de3d996eaeae43095b1be0b875b3719fc025ebe03a57aebc90f14c33c326401cddef93017f48bea2dbeed084e620585ddb34ce83aaed2fb69b6ccab1c
  • SSDEEP 24576:DRvV0Ldy2hY+QY/4WeSGQ2LRXv2QEfP5HVLotL9p:DRN0LY2O+QYESH29/bEJdoD
  • TLSH
    T1E3050168675DE801C8210735ADB4E6BC16693E6DBA11D3171FECBEEFB9367168C40382
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryevasionexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2