Extracted

• • Target

    21012025_0947_21012025_cotización.exe

  • Size

    68KB

  • MD5

    88d8158ca98088d881cd08846dca5f24

  • SHA1

    1c11b75aac23b72b29a47bff55106ef8ac04bf47

  • SHA256

    6d217281437ec6542d839a5f130e001c3df8aa9b20d47f48927600e10b4862d7

  • SHA512

    8cdbaafb8c90fe1e7d3018036ac53048fab1f84f7503cac91d610b4b383c58942d2e1ded25d68d60b73657fc270798017e512898a5d04d76c51a7ee7afd78843

  • SSDEEP

    768:+sX7zPeSAnG9cdeWOkglgS2x3M9hfVR431QWyVsFfY3CF2zInyQS+ST6nkC1:fvPeHn1ebeS59ql6sFQ3giInv/mq

  Score

  10^/10

  discoveryxwormrattrojan

  • Detect Xworm Payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2