Extracted

• • Target

    rt.exe

  • Size

    315KB

  • MD5

    47db83a48f4ce42a918802f20de2728f

  • SHA1

    676554792c422bd78cc6763efc863b52c9c41ac8

  • SHA256

    167f580207b3f640e0b68cbd3bf38770f7499c8be0b4f6deddbc7c8d212120bf

  • SHA512

    54a99695dba773bae591fba6ac9c5c5c9e9f0742ff1c40ebbc316b32fc8a4738e43515ab1977abe1f560d170023c73bdfcc710aaedc79fa0c1bea5b342e5b694

  • SSDEEP

    1536:yzJC0dKuaIOz7Q0gLkUAg4YvRjYEBIU3joFpCm26oq7kd4m4sMXLiIRTCbpvYLsf:ytCmW49aSpgFXm1cC5gYoQN

  Score

  10^/10

  xwormdiscoveryrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Suspicious use of SetThreadContext

  behavioral1behavioral2