Extracted

• • Target

    RV URGENTE!!, NOTIFICACIÓN AUTO ASUME CONOCIMIENTO ACCIÓN DE TUTELA 2024-00198.exe

  • Size

    2.1MB

  • MD5

    a2a55857c207bceda9c7f57f0e2d6d00

  • SHA1

    5c54ca5c8dc1a54accc1fe633dabb732d03b9aa9

  • SHA256

    c8fcdd95c7781ad4d31631ef2d32fd375b0c19f2f5e0b672213d47a5486d51af

  • SHA512

    6759adb8e309de8d28dc37f3d0028798e92f60477e5685f30ea66c10406dbcdf17410106b7cb0c22d5b1131cc4701cee69a5a759fd09fc889de2df65f940fc4a

  • SSDEEP

    24576:YhJLQReYepwifQggqPyIzmH5loQgYrQAiMfXQg9wgKy+1gd7Z4:HD8gqP9zmH5l0YBt+gnAA7O

  Score

  10^/10

  xwormdiscoverypersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2