Extracted

• • Target

    d6ea0caa05d1ecd3cdd04f2f2d1279528d05ee8f98e361f21fc503337553cc6a.exe

  • Size

    34KB

  • MD5

    c9c23e8ec35c88ce322287cc2e7e3a6d

  • SHA1

    3644da59369aba3d19644bc658e8fd7f8baed1d3

  • SHA256

    d6ea0caa05d1ecd3cdd04f2f2d1279528d05ee8f98e361f21fc503337553cc6a

  • SHA512

    90ecb074ab146f79cabe1821dd55082d333523ec104c3584acee2411bbe4fe59f81b8396e08cb0c79acb2c84a930f655ad1a0f9b9a3903e70923a624ead3e373

  • SSDEEP

    768:6b7h81Q27R5Wo2/bHoDd+ntAxV85eeJ8Ym9Py:eh8GcJ2/bHi+mxLeWw

  Score

  10^/10

  xwormdiscoveryrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Downloads MZ/PE file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2