Extracted

• • Target

    a8602f61da135d8dd308b6acb0338f9b9da4024f9ff302490800af85b242eeed.exe

  • Size

    668KB

  • MD5

    14ab397c433b92d64015617db5065e44

  • SHA1

    8bf6233d6689ef9bce781b7999e482906a288143

  • SHA256

    a8602f61da135d8dd308b6acb0338f9b9da4024f9ff302490800af85b242eeed

  • SHA512

    d9f36d85907e77316298a0b5db54c09285fba4de780b130c1a7a9d36f309c428a99ec294e6df2a71402ba2e1dc4b424c1810d1f403a45b8bd2b8799aa9cd121c

  • SSDEEP

    6144:fGGQjEhcjHYHenocjSW0HKS2o72gOE9ftZbWn5eXDSJDRa4S2pjn:+GQjEhCfd0HL9BTMkQ7pjn

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2