Extracted

• • Target

    steam vr fix.bat

  • Size

    288KB

  • MD5

    cef5aa25d01d9b931799245be48fbf2e

  • SHA1

    879bf2dcf51bd29012215118e356208b6f312fb5

  • SHA256

    7d1b357de1bf780a0958cbaccdea596d5a35b9562aacf3285c36725b053d7f15

  • SHA512

    9d677126d28ec50d9686a6fda397004f267e4666a417d89cf7969929a8c0b083b6104075aab5947174e4c4202f28e1d168baa67a64133c9092d912b95152d293

  • SSDEEP

    6144:ORr8O2eA/ce/3Tr6ZgjnPv+XgrDyHsUpeIKnIwwlt3TWAzdwL:OloDcM3v6Zgj+XgyH/gIKn3wltjWAhwL

  Score

  10^/10

  xwormdiscoveryexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1