Extracted

• • Target

    INVOICE-02417869_77319135.bat

  • Size

    304KB

  • MD5

    6d6b6c679309bd938dbcaada6f7820dd

  • SHA1

    ccb02a27885c656c2c52dc94272b91d46c46ac7c

  • SHA256

    e1e32a7e5096ea1ad664b321e1bd1603761e28e3b63025fa02078361545894fd

  • SHA512

    7c2317cf54a96bde7d0cb3d1ed9afdc91e1d35835bcdcab24b56d8bd3c8c3a8320c97c90267a2171d72919c9b6a89e845582f66e76e3354c23f79f5560645032

  • SSDEEP

    1536:eN2lxmAHlCvI8H41j/KnDTBpRcuNoCSsXDht/lFqz5FWJYDzqGHRBWZbgbLxihFZ:eN2lZhSIj/crDhFrq9FFDnl3AIdWOC

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Drops file in System32 directory

  behavioral1