Extracted

• • Target
    74f12634a686e5646b9c11fdbc319231a4958309a146696c0aec28ef205f85b5.bin
  • Size 127KB
  • SHA256 74f12634a686e5646b9c11fdbc319231a4958309a146696c0aec28ef205f85b5
  • MD5 5a9436a28451bfd6ffacd698306fd9ec
  • SHA1 2b62b938b3b4446094aa7c823638adc2fd9d3c61
  • SHA512 d3a3626be0bc16e3b7be8d91981c205afa33ca38a489aae9b071acc8eb32b8d064355326849ac9d229fb494a94c7f73c381f699763eb08f00158f55c5765b833
  • SSDEEP 3072:xGWlD22EPS0rQIvcvn7xRAh2PKkScPGLZZXXyxdysY6td:lgnUJn7bAAymgZZXQW6td
  • TLSH
    T1FDD3AE46E966C2E4F8A9C30C6915120677F00FBB03CBA5BA9F34FC146AD56538F0B6D9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2