Extracted

• • Target

    QH8DN3K9X.exe

  • Size

    518KB

  • MD5

    8fd78d3f0ffc585c0946e347281caa9d

  • SHA1

    1cd95c47a876b367a96b91575ce876f933659144

  • SHA256

    b5a4b1a445b993f44e351821b76c5bdc156c2f2609c6f6fbfc34a731e7d9937f

  • SHA512

    cc692611f688cf60a2d2f396e18e9ab7579832f127084a4c596b93550ecd913a952feff7c52f80f29e8d85217beb21659b5b644a8ea8cb653bbc74f0bb6bf27c

  • SSDEEP

    6144:QC5gmYW9mPMQ/ay6H5hcQMFHYQdH2RYRtO7aIRvHLfaf97rUHZNTrtiZp6AH:jgtPx/uZhaHY4H2i2RvrfY0H7tc

  Score

  10^/10

  xwormdiscoverypersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2