Extracted

• • Target
    WaveChecker.exe
  • Size 122KB
  • SHA256 7ca1dfc3154381c742649930ef86f7d4413150c9d1309f3da6526f842d3e4097
  • MD5 65ec34fd09eb76b07a3b836dccde0142
  • SHA1 d40082c25ece280c38974fe8987c643e8357c75f
  • SHA512 a9e298b38f83cc1e59971a226ed450ada75b5ec913c9bc3a9104abc0f3c093bef357bea1d0e8d8e81b227e0e77b0fbc70b7c6b05fd7275e2b1f5619f231a0c89
  • SSDEEP 3072:ey+Giu6IsFr99SO/8TbQyB0RmWK7QNUrYnpZi+4MeRxkR:e7lr9l1b/i7M
  • TLSH
    T136C3E058B7C00234DBBCAF75657277520238A603C917EA0F1DE9489E6F377CA4A512F2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2