Extracted

• • Target

    94356769733098103745363502109345554335220161306761.bat

  • Size

    161KB

  • MD5

    416aff758a2a587d89b208f7dabdb0ec

  • SHA1

    7e908dee1cfc2885d688d8c0e9c03e88b66ea090

  • SHA256

    897b124a4ef0a2886f3604babd1716017ac19577b5d74abca068ad24b21da4d6

  • SHA512

    8b66d8193011d207d9b24b0a20b76e2099bd3bbaea47d0797faba7a6f9741cae95dc3d4d69943aaad7df882e10299dbdfc49d1325fd30c1128ecfd23a0474a46

  • SSDEEP

    3072:oJl6l20lITvp1WNt4HkboG2vIbuoTkDa+P0o5l1MzFpiP5cNttn:oJl6w0FNt4Hk+gbTy/P0obPSNttn

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1