Extracted

• • Target
    _ca0d6b04fc3b7229e6379ad31799338a552a75f9c5b160cfee4678f88a4500fc.exe
  • Size 847KB
  • SHA256 ca0d6b04fc3b7229e6379ad31799338a552a75f9c5b160cfee4678f88a4500fc
  • MD5 31bec9ae02ad45a5f57624526a2e55d7
  • SHA1 47411ce35483fa807f5abda7450b2cfc53c13c8f
  • SHA512 494e46e5c11724887d3a4c4552b2369db8803cbe2f6443b381dac7546b768cbf11991a8d1cb86a455e609e60357f5d1fd09862aceb7021c3a6a1cb9c8589d411
  • SSDEEP 12288:8XXJfMtplh33KJw5AePRDL487yOMiPCLYfUcsr6dX/V/VtJWESZA1w0s+itah:8XZEtpv3l2e1p3C6UcY6dXNVDD6ah
  • TLSH
    T1AA05E1255F466F45D6BE1BBCC0231C5877F0880793A6D71ABFED00F48A63B88CE66592
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2