Extracted

• • Target

    file

  • Size

    7KB

  • MD5

    f8e6c016130cbc130645e658e06a2995

  • SHA1

    0092a052e3b6d35d36c6b3b510c0a420dd815d93

  • SHA256

    91017e11d0af0c3addbcc9624d6018d783d357b326c6620ed46686a14e33558d

  • SHA512

    a4a4ca6c98a62d5e1c8e609ef80e9a264d8c89ecd9a835260d5488850af514f740f166954e683c6c522114b222dfaaef3292d2f5ff61490c4cc219cc58a058a8

  • SSDEEP

    192:PN2x2BR7VSWyglyj6RMbSoEddJgMuUyTN:AxI7jrM68SoEdvaHN

  Score

  10^/10

  xwormdiscoveryexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1