Extracted

• • Target

    8.png

  • Size

    179KB

  • MD5

    9ef75799925b2ac31fed9e659a16237c

  • SHA1

    56229b949992062e82c97cb202c913a54f0f194d

  • SHA256

    3bbdc10a48535df401713cbc1c29691a835258c8785fbcd58cf833398ddbd5e8

  • SHA512

    dca70f1ae8d790aa3639b283be15b68af8cca79a4690b76e1d9868aa6adb00ad3e6feaf5bb6fc02592d9d56884798954b0a2ea5585b60a83f8552c7b1d07d3f7

  • SSDEEP

    3072:saEodf9Bz5TOU6uCS+JAmqfvZLGH1yGAleW2rJOgEpTYA6nR6LT7Ofuih6WjayNJ:saEodf9uU6uCRJAmqfvZLGHIGAleW2rL

  Score

  10^/10

  defense_evasionexecutionxwormdiscoveryrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • System Binary Proxy Execution: Verclsid

    Adversaries may abuse Verclsid to proxy execution of malicious code.

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2