Extracted

Extracted

• • Target

    450f94a61505838c596764d3e70dce13638ae0086e5695b09264258a859dc42f.bat

  • Size

    180B

  • MD5

    b3cede4b5d517877a96f997ef702fb47

  • SHA1

    a4aa92e6231e8ac310b32ecfd6d8f82f3b1c76af

  • SHA256

    450f94a61505838c596764d3e70dce13638ae0086e5695b09264258a859dc42f

  • SHA512

    5d7e73be8121dd8d3374d773d83f1fc553e748ef863a7fc7d914eecae8d1086dcb17dfc14a36ffd00456802af1f708ea19e8c8887203137c6ecf77c7f1239080

  Score

  10^/10

  executionxwormdiscoveryrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2