Extracted

• • Target

    MapperBackgroundHost.exe

  • Size

    68KB

  • MD5

    be234affb6a450d9ba70e2077b92170f

  • SHA1

    a72a0f9b501867b8f3d3ba1dd19ddedc87f83a3e

  • SHA256

    676805b81537a671b519cd597f2ec95ecc896494499cfc9379fc9dcd1b0b6c78

  • SHA512

    77b9ac2f1301da866bcd798e8dc3353f436b858ed4312b25afada7b3fa607e45438c0782e8d63d65172ca0b8bc9a662e077ad1726aa6c1c04f4528bb538ffde3

  • SSDEEP

    1536:OwxnJg54Z7i6SWMivyrfNGBytkbxaezAIdNAB0OOz6T:1xnJg54Z7YWMYyDNUakbxFFGB0Og6T

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Drops startup file

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2