Extracted

• • Target

    884df6eceba6d2ce19b3994945d37fd2487a012c64345939d9398f6001bf4e51

  • Size

    2.2MB

  • MD5

    d46c0c68803203f7db45a78a0e02225f

  • SHA1

    9d198155dd59799ffd16397243b5047d7208800a

  • SHA256

    884df6eceba6d2ce19b3994945d37fd2487a012c64345939d9398f6001bf4e51

  • SHA512

    3811e601f7dab65bbd8c4b63cb91355b5da16de4528f8f14a941aa73f7bd973876dfd7aab5606d27bfcb9c0e7584317d8337151500d777e4fe455df090e56085

  • SSDEEP

    12288:tOnWCm5n3D7ofordCP4MmT9cFTf7GvgV1JQ5mc7h9bSe/zMn:

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects executables (downlaoders) containing URLs to raw contents of a paste

  behavioral1behavioral2