Extracted

• • Target

    c5f4dab7c8114f6fd9742fed88895a12192bbbfdb5c6438f85c89a645961e142

  • Size

    1.0MB

  • MD5

    e0de437a9326cd6a11e17b6a9fd9963f

  • SHA1

    fd866c5a382e9ce7c5492dbee1e47b90f6b56531

  • SHA256

    c5f4dab7c8114f6fd9742fed88895a12192bbbfdb5c6438f85c89a645961e142

  • SHA512

    18549cda4eb213966a9fedf63e997cd0dd5f4f338237b73ec3873997bde9566b85dc380e645624e7424f85be98c5c3574c544770365e01f7cc5af9a4fa9dfe51

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QLmy4m8bMT0urDgE1tgZG3:f3v+7/5QLIbM3Dtg0

  Score

  10^/10

  xwormdiscoveryrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2