Extracted

• • Target

    ddfddc84dc9e7089f3340846addcc1e9e4f2165348169599ca9814fb0013b739.bat

  • Size

    62KB

  • MD5

    26740c297c3139bb704490f2d5e965cb

  • SHA1

    817f17ac57829b3aefaa468cd6e60a4de88a17cc

  • SHA256

    ddfddc84dc9e7089f3340846addcc1e9e4f2165348169599ca9814fb0013b739

  • SHA512

    f99160e59509b41d29b42978fa9a54e2e58f81aba829c8a38e434b785ed25911cbb36232e37bcd12daa670d82ed338fd7ae1ef5b9227cbcf89a000fc7abf4dd5

  • SSDEEP

    1536:qs6V9eEWZxjq5asZkbmEKUgXEXzICKUnFx7d8u5V:qs6V0E12Hff7d8MV

  Score

  10^/10

  executionxwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops startup file

  behavioral1behavioral2