XWorm - Python Zlib Embedded Decompression (T1027)
Detects the loader using base64.b85decode combined with zlib.decompress to restore the original executable payload into memory, often associated with the XWorm malware.
Microsoft Sentinel (KQL)
Detects the loader using base64.b85decode combined with zlib.decompress to restore the original executable payload into memory, often associated with the XWorm malware.
Already have an account?