Extracted

• • Target

    Request for Quotation.pdf.exe

  • Size

    1.6MB

  • MD5

    e431cc534657e37b3e84065eba53105e

  • SHA1

    fc88bf55a27ca270c2c2dc721c64da6966a0a5c1

  • SHA256

    0e4aa3896358b32016c903f837a762052757ebeeb525b4077062864710de329a

  • SHA512

    4894c6dc19987f1b2e902cfa7314de8c179c85135fcd48ee103def925316e9f15fe65bd990c9c61d61a70672b7c1cff30c6c1ff751654f63327b9a2ce1016c03

  • SSDEEP

    12288:C27f6PD2zYzh+FoVIx+AEA4KLvSt6xjplsi:Vf8xzwFdx+Y4kvF5si

  Score

  10^/10

  xwormdiscoveryexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2