Extracted

• • Target

    132.exe

  • Size

    56KB

  • MD5

    1bc4e67e8e5636713df1be6d4c821343

  • SHA1

    ab2e070e4a1e70ff33e2a17c0ce17eb3e4b2823d

  • SHA256

    a5976230b3e5d8efc40dea84c992209fccee38c06c310ee881cd8d1b0872ed0e

  • SHA512

    fe032a075b5e13d6a1b1e3101c92b4330030d31f507f9bf4a3482f71d8670a3594ca93ce7ca809fd41f2a38d9b71eeb5faa036bcd9f2d97297e21aad05874be2

  • SSDEEP

    1536:/gJbKVjEfb1fI50/igd7RzbnbGC79Obwu:IJIjWhfI50qg5RzbnJhObwu

  Score

  10^/10

  xwormrattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Drops startup file

  behavioral1