Extracted

• • Target

    sample.cmd

  • Size

    82KB

  • MD5

    4ab6133a95c1cc4bf865b0eb5de71ee1

  • SHA1

    de046f1c2516b909e2582bf72c7bf03944350991

  • SHA256

    af741ad4ad174cdcbea9fcfaf76b68ba4ee38168b21248d5e9ce244ddf4073e3

  • SHA512

    9ce2883d993e3f26681194a7b14fd0b85a5886e68da55f6565b14d838f466ee62f24c575517aed3cc63cdcb56d773f49fa6f19d4e93c102d9f07e071578f2bdd

  • SSDEEP

    1536:gauHfl8HCHpbiyGGy+aq/ewn9utsxqdr3hyRLXrxHaq8AdIOGB:huHtoC2GFZGwn9utsCr3uxEMds

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution
  behavioral1