Extracted

• • Target

    BEta.exe

  • Size

    71KB

  • MD5

    4e04e4b330468d08c1ced57a9d4237d3

  • SHA1

    ea29e0c159454cac9295d3a13208ef5ad3c68e20

  • SHA256

    2c0a67858a564a9f8e31bee30a7f3fff197abab45c86a76258b5dff361f782d5

  • SHA512

    eed94bace96ca2667e6cb77369d49159f1250f104b6efef4eebf0818fe2c3ee60ac34c11709ac4680e32408aa9d3ef0f72336d10ad082d03d661ba563d2b32c8

  • SSDEEP

    1536:djgqQWeBS2EyNTGwN+bxPkcL/ADB6YO1hXMUEsp:OEyNT+bRkvD3O1ZMU/p

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  behavioral1