Extracted

• • Target

    6f4fbb8059780db756519fae97b7f00148f1df2b96ddaf9752d9409d45c1a37e.exe

  • Size

    943KB

  • MD5

    40a1bbdd302c9737d10df6648e6db7dc

  • SHA1

    5f9d1d4d3aea4a82542b54a84d0fa7822bd24d2c

  • SHA256

    6f4fbb8059780db756519fae97b7f00148f1df2b96ddaf9752d9409d45c1a37e

  • SHA512

    98fa809cb8b7fe598f07bc61658f39379cddbfbb44ebe4e1ae8882a9ead4406820585d51a0ce836d7f2e40e532acfde61c7ba7868175871f771503a813bd0f8b

  • SSDEEP

    12288:XVTGAlfBpSGC9Ed/Ff6qVn60dP185uk+mzA0pRELuvg8IQjzek:XVT7rhCqd/N6qVlyug8IEaY81Pek

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2