Extracted

• • Target

    wB30XU8F.bat

  • Size

    12KB

  • MD5

    9db325d6143da09edc4e1fe41b152e71

  • SHA1

    cfc1af0130d50fb88d173ebcecaa3f0b16e1f1d4

  • SHA256

    87913ff2c6fabe85812bbc7691a8773cb4842557699151d63fe492f2420fc567

  • SHA512

    3a49d024aca27d1044b9874b1726354a4c002965be3b890a74024ae9a6196ec31df4a8854d1c058c70b6ccd98b0a8b127c323ff0e2dd9d714321ddd362bc0001

  • SSDEEP

    384:CKvwJK8ve177XuvkHs8U06Z+a/PXA3P4uxc7Q7/WlAnY1e++ptdy:TwU1nXFs8UF+aQuQYOceZjy

  Score

  10^/10

  defense_evasiondiscoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Downloads MZ/PE file

  • Drops startup file

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2