Extracted

• • Target

    7524d560b667b8ed62f16bc59772d81f.exe

  • Size

    7.1MB

  • MD5

    7524d560b667b8ed62f16bc59772d81f

  • SHA1

    ac9fae264147b07d6306784d6738e768e89ec389

  • SHA256

    e88f233b6925f8bf72e0b89baaa1fc52d5c7fdc52f8018de86af8cb0e902709b

  • SHA512

    c9201812e59c2411d83c254cae87d4f157747a6cf1a5080fa7c27d9f4276bec00ff671840ddf75cfec2bda1692c7593d4604f55c31eb6643d0362d6898294693

  • SSDEEP

    98304:tPx1VR1MSpVQJu7ikcXqhKRgGJC1LIrip+M38GEcfNv3SsnFx3ai3i/bgkqf1nnH:dxHR1likZGgv1LH6cBSeqi3idqfVnPLD

  Score

  10^/10

  xwormrattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2