Extracted

• • Target

    Shipping_Documents.pdf.bat

  • Size

    64KB

  • MD5

    09433b8bcc804eb2d86576f9064a37ef

  • SHA1

    17c9e11369e65e40e621061cde2da11e479d6aa4

  • SHA256

    370fe2362d5ffa4bbcf6dd32cfcfd744809f5ae9c951c6c66950da695f554679

  • SHA512

    d64cc7c3e095507d2ddfa324808b98db01463007ae2c6f6eb4e6523514340ba32d066f9ae1f46019c2a1787625c028bc369cebc3cbb8800650a4205c89ac28f8

  • SSDEEP

    1536:7ZlVZkbmEKUgXEXzICKUnFASrMO2hX47MtDt8TpEn3WK2op7BeX:7ZeHfiSWho7Mg9WMX

  Score

  10^/10

  discoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops startup file

  behavioral1behavioral2