Extracted

• • Target

    svchost.exe

  • Size

    62KB

  • MD5

    949f229078d60fe3862264f9275b7888

  • SHA1

    5882bd15822ba4f2b67122459ac23d4a7bf38af8

  • SHA256

    c13d9f4ccd9e4c95c416f55fa9a8a923b35f34ab8e269542bfc9aa5833a990da

  • SHA512

    aca55359efdc9679d5277e738922ddf9443d6015a7989552eb14388cd13d47ddf42ed536190c5dc725a3a5b5651b21e5f0b02339e0e38c690d9edcc3e2e225c9

  • SSDEEP

    1536:anBpklFiYq2d+Jyu4Qlc+bT65kKIIXGK6DdyOeZMJJwCJ5:o/k1qEC4F+bTnBIXhOeZMJ/5

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1