Extracted

• • Target

    dff135bed1773d2314078ee9c461bdf377ee85e67330233a1e8d65d89071eee8.exe

  • Size

    506KB

  • MD5

    ce7db8bb0bf0e611dd14dd507b88f0bd

  • SHA1

    edea5e5f4d8ca559210e01a9882e9a2dc99b6ffb

  • SHA256

    dff135bed1773d2314078ee9c461bdf377ee85e67330233a1e8d65d89071eee8

  • SHA512

    4e162916255fc12062fc00dd3d30bfec8b26db7aa5df454e852e35c2f01b168620c3b6eb300812e1e119d93a8963efd36418ab4351a30d9cdb69cca8442e95c6

  • SSDEEP

    12288:IrgGh4koEP2fgULk+R02jr0QQ/sYNVo5W:IOPdTtR0TQQU4Vo5W

  Score

  10^/10

  xwormdiscoveryrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Drops startup file

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2