Extracted

• • Target

    368e9ba787825581ace40c910363082e9541442840c3a2c715b7acd37941717c.exe

  • Size

    93KB

  • MD5

    02a8f63cf0794af1eda36fc824795811

  • SHA1

    3d9cce7694776b976918e51ac2bf3d1f00c9fb41

  • SHA256

    368e9ba787825581ace40c910363082e9541442840c3a2c715b7acd37941717c

  • SHA512

    43ee74e7c23fd57feb9fc53da4d29a1a3202ed2c00c8ed5243ab7cc559b17aec1634392b10f81463fa26432ed025e02d7a620a068613712c05a4183130a6ac01

  • SSDEEP

    1536:DccsFRCo9GyL3qHsTItlEkdChnH80nm+CRNHsi64oJTQYeTpgCj/jf0j:/sFRC+L3dQLdanH80CbHLNKSCCjzc

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Drops startup file

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2