Extracted

• • Target
    iiii--.bat
  • Size 258KB
  • SHA256 806c0e52c5343d9140e3c8fcb804e918f2a900896d664f3286d45ec2f4df5fab
  • MD5 144ab3c20622ec01122ddccb2d7b7b57
  • SHA1 a9c5a22b83872be41fec6cc3e11061069f4175b0
  • SHA512 403dd70d2cd26ac114a4bef012252287e4c833a383f8031ca9595137f085e0cca528eb8eb91d0af58e1272339fecb889c998135e278a0f757bd23ddd5f15a452
  • SSDEEP 6144:2uSa72dCUu8Q5gNg4y3mEMJNwL3umliJgb8xapFtfMoZalCk63:BUu8Q5gKXWEMJNwL3OgzPzZalCP
  • TLSH
    T1B844BD231312756AED9A4BD8ECEE2FAC8A9D6ED611B7B019F758F4A314141321C3BCD1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  behavioral1behavioral2