Extracted

• • Target
    oci3o4 (1).bat
  • Size 507B
  • SHA256 7ffcaf8bdd123035296666812a5e843c6468073ac9f0e72ae74a64b6f03989b0
  • MD5 b1a897965091dc310839762406118c37
  • SHA1 8cb144705409ab4f2eef20deb5ed9c33a6f13003
  • SHA512 001f4282cd3e512477aadaa44a3f501fe2e98ce162f07814b8d495fa3c3f2c2c3c4779a2f33b6057cf2eba7921818112d923132d30dec52ff5be4f7838ae4d54
  • TLSH
    T167F0C0131169978C159845F211247CA8832D76CB36241A8D63F58B484F8226895DABC4
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  executionxwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2