Extracted

• • Target
    awb_post_dhl_delivery_documents_06_03_2025_00000000000250.bat
  • Size 64KB
  • SHA256 999ec6f3dd5816786295500cd790941727bdaccb9640becf284938bda7cd73a9
  • MD5 fef11d117754e450b937fd134f9dba13
  • SHA1 1024f7c99c81e39f0f53710d24e06ddea52082ad
  • SHA512 db20ef27451bb79a9f21b9213e29e9ee40326c8b8dc28ba824a3aad3d901481ab18acd49d77ee0a2d68799853db5ed1ac9e76e8515070ee83632181a141a0bc4
  • SSDEEP 1536:8nDChFG71EIZWgZkbmEKUgXEXzICKUnFT3mKHWCW7zxk7Qvc5MCzAlZt:DHft3mK2Cuzv/H
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  executionxwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops startup file

  behavioral1behavioral2