Extracted

• • Target
    4f0d8a7c1e35b0645e27e37d53cf78da528851b31cc118a5e1ed8a490c56ff17.bin
  • Size 210KB
  • SHA256 4f0d8a7c1e35b0645e27e37d53cf78da528851b31cc118a5e1ed8a490c56ff17
  • MD5 3874679ca4978b706d0162547b5befa8
  • SHA1 fe67895240db7e21ff5bf560ff9b48d91c9b6b9e
  • SHA512 3f8e1d6fb852c26cf039e6e1d9c54f3d8c1ca1e701f6ba1db2978eeb3a00c9b5f267ac401692511a42605064715b79a57afe46af3f83044b8f7315bfde35ed2a
  • SSDEEP 6144:IC22Kw5vOixjUa/XeqtpBikrg2jMn42bHEK:N25w5mixYe1088rL
  • TLSH
    T1A624DF087F54386264615FBCE44FE80D1A9426B9DECAC24A093ACBE60EDEFC75537819
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2