Extracted

• • Target

    1dc12b7529e0f04e870bc5c2aa78f053f2a0602a291ee5401ca4db11fbf6b9bc.exe

  • Size

    766KB

  • MD5

    b808d5b7433f2f77bdbf5fd5df203ec9

  • SHA1

    5a9c635489b3fecd8d9ecbaa557244df8338c762

  • SHA256

    1dc12b7529e0f04e870bc5c2aa78f053f2a0602a291ee5401ca4db11fbf6b9bc

  • SHA512

    7a9a2c058d50fc9e60ec71698e284607ac8b38942b69bb60792d4346937b5daa32ecb03aef02e694c66bc20934ab9ac40c91cb87a3fa509863b98e71dacbf266

  • SSDEEP

    12288:Mdzd+m39dkAf5YSyBThO6QglvZUXI/KhrlpAYxylfB/VL1Fb91J36HAgVU:MdhkszyqFglRGI4rfAFlfB/Z9f+R6

  Score

  10^/10

  executionxwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects executables packed with or use KoiVM

  • Suspicious use of SetThreadContext

  behavioral1behavioral2