Extracted

• • Target
    DEKONT.bat
  • Size 133KB
  • SHA256 581ccdedd0f1e52d4827a25038c0eeb4f3526cbcb430df2cb3f8607995805991
  • MD5 336388dbe238b1963e68cd1eb58ae2a0
  • SHA1 f5d2611acc442fac0fb280b1422d9dddf0fd6c26
  • SHA512 944b3773f2253e8c7a0b513764f2e49cb4a3b748a1f8bf89d4943da802458dc553558296cad1ef0d5454fd464cf173eb17d8e21efb58a131f1458f3e2a87a247
  • SSDEEP 3072:17akRzxdKfKlkVlbg3/MxpoaT7/N+9Soqf5w44og9kyfluJRHcxXYaxRya3eur4/:17lRzxdKfKceIRkEnwpqf
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  executionxwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2