Extracted

• • Target

    Original_BL_Shipping_Documents.pdf_.bat

  • Size

    64KB

  • MD5

    c784b6876259c872711eaf78807e5756

  • SHA1

    ef62eccd9a17ade1eaa1b9f17965809e61e1dc06

  • SHA256

    1bccd23f3c83974f8fb8066bf4ceb6b2faa165af846401080bf2cdccd1ef79da

  • SHA512

    4a81baecf18a5c02a1a8058615ddda804c9c52e38853392530207d3c823e1c8cca55ee4976056abce72f06cf4b433c2ed18522e805e536a8aab1a4693c54f26f

  • SSDEEP

    1536:6im/0y4lWcfZP+UtLdxgNp2VnVCiJZkbmEKUgXEXzICKUnFN:6NszDfZ2UCGnVCiIHfj

  Score

  10^/10

  discoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops startup file

  behavioral1behavioral2