3c87c841063eb5f0e7a5a761add49376abdd154486a0a98439deda0e5fe8a538

Analysis

max time kernel
128s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02-03-2023 00:15

Target

XWorm RAT LATEST/Tools/vncviewer.exe
Size

1.5MB
MD5

b8d15cd10f1e9ff6adeae64fbbeb755b
SHA1

f962549e42b58a056b11a9ba9750a30bc76844d7
SHA256

823168f7ff268a96aa80d915d946411ef214e7597c73312b19f9723d704b1396
SHA512

1478c76b08a8aa9cf9db927ea371c192ade81d8e27d394613f05aa60011fa8bc46ada115ab4c8c9aa75fcf86dbb62f7089a211f58270c984a204c91465cd07af
SSDEEP

24576:Jj/05kjHhc0Vo68/RWyVae30Zh6FSCTpf2kveQn5poM5lcOBo:JY5kdc0G68/RVoe3+MTZ2kFroM5lxBo

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

vncviewer.exe

pid process

336 vncviewer.exe

pid	process
336	vncviewer.exe

C:\Users\Admin\AppData\Local\Temp\XWorm RAT LATEST\Tools\vncviewer.exe
"C:\Users\Admin\AppData\Local\Temp\XWorm RAT LATEST\Tools\vncviewer.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:336

C:\Users\Admin\AppData\Local\Temp\XWorm RAT LATEST\Tools\options.vnc

Filesize
22B

MD5
24f5e966d65e79745d3303b950496810

SHA1
76b05ca8cac7a49bec0c413270e4af5ce891dbf9

SHA256
9b7645a27b48ec94958a9a95326860c811b9fb3b9d82901102671e7c64416d3f

SHA512
b77bcc8f62db51c2b120e664d9f78c1896a943d56d4e3fdf7b4520a021458181cf70457ae486b12439905351bac8df875320a02b79b0f8ad4f9eacaa00379c5d

Download Submit