Extracted

• • Target

    decoded_17264d9b.ps1

  • Size

    604KB

  • MD5

    09dd542e53d7f48b5a3d60032e954d35

  • SHA1

    508513c1ab6332e8379bea6e078a206a36ab1df5

  • SHA256

    079d337d66f2075d4e16ae95de3a5afdaa053f69a662fb21e6b6abfb28efb82a

  • SHA512

    6baba1dc00a68a39e428fdd243414614437aac08fb619317155d12c780b9ed4a1a0d598ba45d9ba25c5dba12fbfe056e878a46c7b41469c125347ebd27b35a0b

  • SSDEEP

    12288:7Tc6KAxcKt/GV5Xrh8jcN9pG021bOMbL/GfDvJUwXW9:EeHunbY6S5OZzmD

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  behavioral1behavioral2