Extracted

Extracted

• • Target
    DeltaClient.exe
  • Size 247KB
  • SHA256 e6200180f0bd4d065539416f180c431e3e64dd8f690f188499c6da2faf8b3626
  • MD5 24239fd62d9ca15476cb1bd25653615a
  • SHA1 679d85ea8a7235921c3e604d8ab66ea897383b49
  • SHA512 9b4e2e02cb3690f3475bd8a0d1b7e2433380a5086e8ae87896a82cfd6e7c93b6740e8c40e3b8cbcaa21efe30200a98c11c78face55f59a50bf350d7d463202d8
  • SSDEEP 3072:O5tFX9jagVtcSZpdubSKRbYkQG4AjoHAMNJ0vGAei+OjN+:aX99uqk7ogMaGAd
  • TLSH
    T12C342215E9EA508DE373AAF11BF8BBBF8CAAE563140960F6234177064732980CD5E735
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistencerattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1