Extracted

• • Target

    Item Specifications.exe

  • Size

    1.3MB

  • MD5

    5e8c689ae7f342a2b2dcf76ad9f990d4

  • SHA1

    dc659d8c8284c0ec2d5cd4b0c4dd3a250d481331

  • SHA256

    b2e9b488e12360fc455512ddae99dba10dd455df423853875e89ac1ffbdd06be

  • SHA512

    46bd683b51c45cc92d5b35c236d8e339ab808cd87465eebd7f1a96ccdb28f994e0048a185a46a68dfd106e6fdd6e46a75c85caea180c03ac20ca2e3e778e64c9

  • SSDEEP

    12288:0kjmrocDPyNhuTsAGBDNMrRbeyBYidXG4LrXFb2N:0ZbPyNqsAwyFCreDJKN

  Score

  10^/10

  xwormdiscoveryexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2