Extracted

• • Target

    Confirmación de pago1.exe

  • Size

    956KB

  • MD5

    43cb0ab95c193e4c0929aca7fbd6589e

  • SHA1

    ad6e821b83255801ddde3fe162c7a8e93abe5c33

  • SHA256

    5bbf73a1e1f6bd7fa7885fc8e052e36920d9ac928b97ca9db978676664a2a064

  • SHA512

    2c0c14ec714e1b1bbaeec624a8a6899ee8454e1c6b6350bc43c2168adf1aff544763864ed7177d97bbbb53c8205daa2549b45d5fe2663bce19cb6f4447d0d4f1

  • SSDEEP

    12288:jzjLf30WH0mkPStI1lRHIZAtGW1wTlnKhKKKNbi3mw:fjj0yYx3dCAMbiP

  Score

  10^/10

  xwormdiscoveryexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1