Extracted

• • Target

    2v6pTG

  • Size

    500B

  • MD5

    628907342bd222d29d8ee5a7af8474b9

  • SHA1

    55aa19207183854c9eff6004675392db4cb743e4

  • SHA256

    a637b82debf0e7c1b3167b921d7cb7386f80b399ae5c23e7fd342e3873977870

  • SHA512

    8fbb7d78a21584cfbcb78ead273f120e85e54294eb42aa131f8245a4fdf28d6d3bfeb3fa47df3fdb3645d8c6c912eedcf95c8bfae341d7ad98b159afbae4d49f

  Score

  10^/10

  phemedronexwormexecutionratstealertrojan

  • Detect Xworm Payload

  • Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Drops startup file

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2