Extracted

• • Target
    520aedf724a2b6f2d9d5b713ef6c31d3140760071232f6a2ece60787668db959.bin
  • Size 1KB
  • SHA256 520aedf724a2b6f2d9d5b713ef6c31d3140760071232f6a2ece60787668db959
  • MD5 e2c9e9e732018b45255958f6757568bc
  • SHA1 66c75826f850709fbd55dd7f046b624d2c606549
  • SHA512 28a2011ac8f807d02fa5010f7e8af92ea4458a4dc2f6b1489cb24632747530c9c6a752651b65d1ee96910ab0b21df460bcea727d350f2d511cb30e5a7d46c95a
  • TLSH
    T1C741B684AEC8949E59D0117E7258AA4AF791139E497934B1FB8A50F040DF6CCE2BF8E0
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  discoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2