Extracted

• • Target

    AP Remittance - L - Ref S158578-1.bat

  • Size

    37KB

  • MD5

    f40915eb2575e2403e865214aac2259e

  • SHA1

    5f650e70eaa8e17789d6d0bb791a7632f313ff92

  • SHA256

    0a5efcc3818622baf79ae660a24c0de5895410bf02eae8d6d913d8bcea9aa92e

  • SHA512

    08ebc8cee5a54e27737ab218ba49785833d59be00650ec9f3184a8e19fe1a4ce3c30f6369ea05bb0fc674f43f98cf4bc0b26fbc1a3853acca5bebd5bbf576e5a

  • SSDEEP

    768:qgvoJ5VJGvuBmOu0mGP4Vx9GCi3ALIKTxz5ok89pkZIT:qlJXJGvum6RPLCX7T1x+T

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2