Extracted

• • Target
    southwestbestthinkingforcinggood.hta
  • Size 25KB
  • SHA256 339135ba0e274e7540bfa429f74b943a6b6a42a39b170f783420568720420a87
  • MD5 7c4bcd9594540d807ec187e20e3c4c9c
  • SHA1 8bc561c8c9155a647ab6876b8f5f25f94c003f1b
  • SHA512 7215b605e502949a84e19f260358697026565684390c7a893f715752e1a643c374dd5cce2b0eee7f78266885364a2a005b979e8edbc3e54c69cc7e6c40e5c00d
  • SSDEEP 192:Sp9Yp8toCn6I4+/5fGh6TS9FfoJTPa6qJGyqMPETTrW26:SgpPQkAfoDnfOyfJGXMPE/rW26
  • TLSH
    T1D3C232B54E4A60096DBF279CBD381E1CA4DDA329197631AB38F4F7CA5F914032562CEC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2