Extracted

• • Target

    script.ps1

  • Size

    50B

  • MD5

    f7907aaa36ecbdf6ea474650bea2b747

  • SHA1

    11356251ecc1dca11f6e372197d4d757dd6eb43d

  • SHA256

    30d852a6064a9f9e57981364edbee0c7a1fecc1d9681bb2a9255e3b13da0c67f

  • SHA512

    8c61c47b5d20e41147bbe3c737cf033bf00392e6dd69f8fab6dca4f54170378fef7233dccf7d8c1eabc322240e920168ed9920af0a3a83a1d13d212eff82b25e

  Score

  10^/10

  executionxwormdefense_evasionrattrojan

  • Detect Xworm Payload

  • UAC bypass

    defense_evasiontrojan

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  behavioral1behavioral2