Extracted

• • Target
    https://cdn.discordapp.com/attachments/1236808584256553051/1236809096150126664/Classic_Tag.zip?ex=665856fb&is=6657057b&hm=bb2a195faf9085e5d2688dd8ac6b505ccca9e3f2996736a1d3c2441a2c0d31df&

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution
  behavioral1