Extracted

• • Target

    XWorm V5.2.txt

  • Size

    61.4MB

  • MD5

    cd69a793cfd9e50998d5cf2e40c8701f

  • SHA1

    a6d8de061db76a5c04e8c04f64417a5e3221b600

  • SHA256

    1b418092ab7db0616964e4e6fa1b7d87c0e50bdec33f9825a19daaba8a5f4c2e

  • SHA512

    dd334e71b8e2b6150829123d8fcffadfc350a00aacaff2395ebee4f4cf61b629bc457d65c6b6fb035d1c3bf3470fc2621a80bc43938b572e8a8b17eefd8422b0

  • SSDEEP

    1572864:XXYrCTvb1MbQ0/4ZtmBb+Lj+v4IY1rnXTrCTvbGxRQ0/4WHb+LEbgUSiaG2FR:XcuMbJ/42a+4IY1rn3txRJ/4hH9GG

  Score

  10^/10

  agentteslaxwormagilenetkeyloggerratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • AgentTesla payload

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Uses the VBS compiler for execution

  behavioral1behavioral2