Extracted

• • Target
    Project Inquiry for Well Head Control Panel Project DMA0036.hta
  • Size 2.2MB
  • SHA256 ea92bb8faa05e607e95a5fca94809b9b8f050b83d812f337c1cc50e2fd1fde3c
  • MD5 3320cfb765ab73122d93b40d5c2b1b0c
  • SHA1 49cbc6cd900b522b57542f9ad476cf0517c833c1
  • SHA512 a16c7d57516d6806220009302dad8c13f0922b7b6acddb3753f6094101c69c512b3ff10ad220538bbf5ce15729c5b0fe722e1c924938a56ae11715f8226e70ca
  • SSDEEP 3072:KAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAy:H
  • TLSH
    T1FEB53B9E07550EFD8D35BB15CD306E16A9B094AC4DB3AE29221B36C0CE5BDE30392DB5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2