Extracted

• • Target

    Moon injector/Moon injector.bat

  • Size

    195KB

  • MD5

    6eabc08b51da854cc3ac85f85952a16a

  • SHA1

    bd5e54e73a40d1330fc4e919adc2f081ece29d85

  • SHA256

    9489825845b0248a40b35b24d6f80b79383a9edaf08e66e09d57c75f7fe56f1d

  • SHA512

    816d4eb783e7b77e374d05a57b512f8945b1581ec2a9a363fcece0eb15ca12928a6c3a7eee8f0007c878a9a476309bba5e8806167bb025892173d6a49305347a

  • SSDEEP

    3072:MIml5Q8bTXiMVfTOJS4b/ZxIEp4v4bSfo693+ag6qR97njpfV/c+Xp7JkRJf01M6:Nwf+nb/8EEq6I6kDlVq2MTK9SXn63

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1