Extracted

• • Target

    00987654345678.exe

  • Size

    833KB

  • MD5

    a849578e8bd54ed3528453a03dcd8760

  • SHA1

    fc3ea5f444fe938916b5be4cf50153950e793c12

  • SHA256

    c6af80e6ed0b9f93b7e14e956dac74d7affe71097f9ab14786e8fdd0469f4d25

  • SHA512

    846f8b31be8499ac17e42e9716bb6fa5b31003563f694c445ea55148855e0c0bc622b7c45049bd6b45b60d041a2ca2ef4f1dcbac0df829bc4684fdab208508b4

  • SSDEEP

    12288:R4YIM64tl6UqjSds3Yfg8TgDJavO3LnXnvAQWWftmUsFVAZL/xtjk65ek2w5KM/:RkYnsd1dMyF/xtj75T2a

  Score

  10^/10

  xwormrattrojanpersistence

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2