Extracted

• • Target

    DHL EXPRESS.exe

  • Size

    1.1MB

  • MD5

    a4f882b8dfb6c075effcaf592d5662f8

  • SHA1

    c3b5d0b630a8575304fdcc92023fb5b3c051c1b4

  • SHA256

    999793a77939720fd339a4a06bfb8af07523f433009b1895b8dec743d4026008

  • SHA512

    5780b1cdf63db3826fba5dfc0defa7672dab46782c693e1f7f629e3a3cfb13708d36d9e61872761eadfa554c3e553df28003862dc04dc8f6472fc5494965cad5

  • SSDEEP

    24576:dAHnh+eWsN3skA4RV1Hom2KXFmIan9tlBtuWBd88PBE5:8h+ZkldoPK1Xan/jwWlQ

  Score

  10^/10

  xwormdiscoveryrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2