Extracted

• • Target

    AMORTIZACIÓN BANCARIA.exe

  • Size

    2.5MB

  • MD5

    7360bb6297d84ae2464be5a28dbf66c9

  • SHA1

    7be0c4b196d52f98687d585e3b3f39b3ae5d9cdb

  • SHA256

    6ac528d67fa33fd955d13d6de332f68d924459e0c98ca9e1b2676258b1d63bfa

  • SHA512

    0f08d4eb8a414d5abc6db20d02b458668574614b16a075c290590f40d074e3b995cae105fb0a4b013f29852d76e41b3cec75aed7f4b6fd8d5c5a49e0779b7842

  • SSDEEP

    49152:p5zkILuBjGAldgwTWrkACPNtRfKPO3nKKtdpmYXRS4tlRz:rvLcSAbfTmkAC7RD3nTdprRlRz

  Score

  10^/10

  xwormdiscoverypersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2