Extracted

• • Target

    RESUMEN TRANSACCIONAL NO 987657456798786765476890.bat

  • Size

    47KB

  • MD5

    65d8a93edb5aeb9fc34964dea9f98602

  • SHA1

    76581dbf1984576d325e108c585cd7fbd0b09006

  • SHA256

    8c47e2ff28df3de6fa35509c4c3be6069e1a99fedea3d6992f61c53d49b248a7

  • SHA512

    9105a7e781eeea5db245a72b86606a2d681a9eefc0e23c1da3053ee1b61635320a5c1e1f53ca56296f5844cacc736de100cc65930c85ee4f07b8546225418b47

  • SSDEEP

    768:aoc6FkLLiNhoc6FkLLiNIoc6FkLLiN9oc6FkLLiNRoc6FkLLiNPc1aa5oc6FkLLx:aopF4ONhopF4ONIopF4ON9opF4ONRop6

  Score

  10^/10

  executionxwormdiscoveryrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2