Extracted

• • Target
    00c866d489bd11732441171441b8db0a135c76bdb7bf5c3adb4da66e97dbed43.cmd
  • Size 6KB
  • SHA256 00c866d489bd11732441171441b8db0a135c76bdb7bf5c3adb4da66e97dbed43
  • MD5 0b65dcbdc755a516181f47d69f5aee10
  • SHA1 fc9319ec254c2be1b7ba5174d36d142c1ce20440
  • SHA512 e37aba32337a5bf8793721d8d9b9582c906b9820ace2a831d1f6e9548e6631942df0bdf6b56f07c1420fa7ade2d3a1e34bb27cab4ddc7d57a42672919f1ead1c
  • SSDEEP 96:vEWuwXqdcs0faFF/oW8NYEpyGakOwJyZLLi8lTxd7Qhn004g6bnecFhZ3WjS:vurF8NY8yGywAL2Ox5QV004gIFhn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2