Extracted

• • Target

    6857d59d1179d9e3745115f7e08cde964c3cee54bb91fd891bba282fe226eb2b.exe

  • Size

    319KB

  • MD5

    d8ea07f0f0072e6ae8ac3b7996941eb7

  • SHA1

    24a6d36259ca0d0c89f46411da822a7f2683beaf

  • SHA256

    6857d59d1179d9e3745115f7e08cde964c3cee54bb91fd891bba282fe226eb2b

  • SHA512

    7c44f2746117f35e8bd8cf40327390edfd7a33650a42f3a8e110de3f1eac02649ec50988c9be956968627af0682e22edbfa442fbf6f206a770c086289d88bbd3

  • SSDEEP

    6144:Lyh4ZwGcFZxO4MvaL7eS7sZXl1YoEhVJGfT/zoMWk:LaZc4MBS7s6sfXotk

  Score

  10^/10

  discoveryxwormrattrojan

  • Detect Xworm Payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2