Extracted

• • Target

    company products.exe

  • Size

    965KB

  • MD5

    77a2957f0b36feb1b71e9a7bb2d40d33

  • SHA1

    272b5e1731b0e00ab84af461adae211297a35386

  • SHA256

    17342376576faeacd5722d9f09635eea207de2343f4d81e67cb35bb08c18dc8c

  • SHA512

    2ab5f17a2d2b6d1369cd410b5fe3cce7eb880313b1941012ea95cae55ed8be2c4bc7b7c9d1791dc4187fcd433b8b5a414842f8e8872ac195e88752875a6cfc4d

  • SSDEEP

    12288:2hkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aI9AalvPpfK5I9H:mRmJkcoQricOIQxiZY1iaI9tlvJ8IZ

  Score

  10^/10

  xwormdiscoveryrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2