Extracted

• • Target
    Microsoft Office Activation Scripts (MAS).rar
  • Size 4.6MB
  • SHA256 54b76fb69edddc9fdc3a738ab3f996409de84196417907ad1ff2a7fae63286e6
  • MD5 5ad259601aeb9e8afc8d749c035e6eec
  • SHA1 2b4a6fe0cc47c212bf94da9f2aabc6641f0d86f7
  • SHA512 55f87507ae77f2be127369dbd629023c31eba800e4dc45745045f59ef8b4e187ecca53e0d0bf2b03c2a57cda480176bf39b99432108d89152abf68562367f8d6
  • SSDEEP 98304:3vhJfrRtnWREc1I1sN3a7CzyJrC3CMSIJ79nFCpvg9jBuxOT88nF0C8C:3nfbkW1w8CGQSI9wvgK8ydC
  • TLSH
    T17E263372D0F88E37C5DE9A416A5D471410DE40A0FDB5BFF3B8BB14AC1AFA3792218259
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiondefendnotxwormhacktoolpersistenceprivilege_escalationrattrojanupx

  • Detect Xworm Payload

  • Detects Defendnot

  • Family: Defendnot

    Defendnot is a tool designed to disable Microsoft Defender.

    hacktooldefendnot

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1