Extracted

• • Target

    20d1bcb55070399d86dc0e0d5e599f65964e69329149743d5be11e2820580eaf

  • Size

    62KB

  • MD5

    af0c3a431e9b201affa69800f4c9b467

  • SHA1

    44e4b88134ee271322ba6487b15203d8a19a1946

  • SHA256

    20d1bcb55070399d86dc0e0d5e599f65964e69329149743d5be11e2820580eaf

  • SHA512

    2230664460c9fe5d281af0e3f9ed6cbf5564a0caafd67dfda9b223bbdabb13525fe5cdc37fbd14e41b76037e08d93e497618cafcc457cefcd3df9b367b15f849

  • SSDEEP

    1536:CpPOMRDpck7zxP2Fss5+b+WACjr1/9x8OrRhMc:cP7RfM+b+W/1/kOrRec

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2