Extracted

• • Target
    Maersk_shipping_document_confirmation_request_0000000_10-27-2025.bat
  • Size 127KB
  • SHA256 0578ce8d2d10a710e7ccbc33fef0ac605153a5928eef55725eb7bedeb5479518
  • MD5 2a0808c5d4840511e1e6fd7b17d1c7b0
  • SHA1 1445ae26fe37b2c89e7cf85c09c0770b1188dc40
  • SHA512 2c83ab66d37a94b274826de040a5ef26ee1de1260dd8e54e036ad5e344413386703c3e2fe2b90950af80e293ccb88fe5acbb360dee9f71e70d84cd6ea59af5a6
  • SSDEEP 1536:l47hjjtftL8mTMqr7AfbYCnEMq4EWUFvapwXdjghLgJm8ZpWOgknOGOKkZn:K7hjjL8oM+7AjYCA4EWUF5Np08Hwh
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  defense_evasiondiscoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2