Extracted

• • Target

    8bcb1766e1f236382b36fab2fc6a8ee385275c0acbf3067471cd9b35703f2875.exe

  • Size

    620KB

  • MD5

    ce504e263e64e997c9dfb2b4953d6ed9

  • SHA1

    acd670aab3e783c87b1ab7781068f44b5379d83a

  • SHA256

    8bcb1766e1f236382b36fab2fc6a8ee385275c0acbf3067471cd9b35703f2875

  • SHA512

    fa990cd9f3e787f78ffce86cc54442750824ca7e7b0195d925809be8563db85bd692b71321f4ecd7c835e4e2f3fc77ac7d6669384a334f1029caf85f7904c18a

  • SSDEEP

    12288:A+1AIO8DfvjXUL90+FuS7X8pVejWT1On8yEyhLreTAEBFvkR:A+1DfvjXABr7X0sjWxOn8yKTAEBFq

  Score

  10^/10

  xwormdiscoveryrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Drops startup file

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2