Extracted

• • Target

    daae736c8f04197fdab7aca6a9d79492272b03b0b0fb7a9f844810c2737ad84d.exe

  • Size

    1.0MB

  • MD5

    468e18a1e46996a9e12aeac76580c6ed

  • SHA1

    4529b55ad5c142e320ca8e0916b175c61f7e8a92

  • SHA256

    daae736c8f04197fdab7aca6a9d79492272b03b0b0fb7a9f844810c2737ad84d

  • SHA512

    bc6faa2a4bff36301c411896a6271c70c7eada5bfdffb7456440a0e499f6467c27532484c1dcb0e23a7c1aa43376fcea697d77315c1293840733c1ca763def85

  • SSDEEP

    24576:wqDEvCTbMWu7rQYlBQcBiT6rprG8a374rnT9exfxOkl:wTvC/MTQYxsWR7a37YT9exfxh

  Score

  10^/10

  xwormdiscoveryrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2