Extracted

• • Target
    XClient.bat
  • Size 54KB
  • SHA256 ff93d90b297e3172501173aaa6144b0939ea15dd9c8f8a4c563289e5fcd252a0
  • MD5 9d48b2bd7a1413af66cbc2cb3c7c1836
  • SHA1 81e0dba33f51a433ea57836a69d3e188b77b76eb
  • SHA512 dcad04110f1e4db7c587068b7350e2a1d96f001490a77dbc4bb12f5c0563c06a45fe3b267ce3eee49d9b4aa099f8df2f93e11b7f918ce49097b89787bc1e4f2f
  • SSDEEP 768:2tsEP1iaGWBTDyKpf1Qlo3sEeBjX5QyRtkfLRJvYq+2cNb53CxVN/jbZ1WXH2xGs:IPssVB1Qo/+/kfMHN5opVQuAkD
  • TLSH
    T14B4357C72E38D67AE1D3A1D1B5E6F8710001BE1FA80952F78443BA1D4DE5DE6CA8C46E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2