Extracted

• • Target

    ABONO DE CARTERA CLIENTE REALIZADA ACH.exe

  • Size

    944KB

  • MD5

    fee033f332a3969e9fdc44a3d6b063fc

  • SHA1

    4d7a1aebf503779d11c7234ecd743fde22c90635

  • SHA256

    8486df955b21ba53ae0f4e3000e553be9a52d5782327830b9ed11cf05e4ea1c3

  • SHA512

    6bf90264a34124dcb945523a82a26b9865700301a3022df603b17059d61396d665ca50ae89d52f364ec51c500da326dcf65d1f056d42cdb24b1c02e2759ccf67

  • SSDEEP

    12288:Vgx1dICGS4J7P8d4d720RwMw8aO9JIq5E7+vfsItPK5z7lenbsGyD5p0:VgUSk720RGs9JH5EjI+knINE

  Score

  10^/10

  xwormdiscoverypersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2