Extracted

• • Target

    fc7d4533df74ba71d5ffe89d29601a3f0fcc4ae3388e61fdb7e3b15f4a7c9715.exe

  • Size

    1.5MB

  • MD5

    378b2b52314f041dfd56b7f5074fe315

  • SHA1

    450d844565c9917e0ebde24c702b3d84d021fe6f

  • SHA256

    fc7d4533df74ba71d5ffe89d29601a3f0fcc4ae3388e61fdb7e3b15f4a7c9715

  • SHA512

    3e3998db5f018add5dbd999125be2e06d2b2760d556a917b1a89cf3afce592b618e636b9381447244e9834bfe3d469d734c07d2d727755c5b828899deed85506

  • SSDEEP

    49152:54dI4az0DW2O/fdDA95vPu0L5tY9S8xLGtznIqtrjHr:WI4a4Sndu5HtY9HLGB/rjHr

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Loads dropped DLL

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to execute payload.

    execution
  behavioral1behavioral2