Extracted

• • Target

    Raku Loggerexe.exe

  • Size

    173KB

  • MD5

    9bef0de02ed2484a0e31e6189cb5c662

  • SHA1

    07261e515796ff5d6785216a4431dc955c802821

  • SHA256

    20a79b6bc521e3882b8b0f143f8c0c15a3676f33efe2defb95272c2a3feff34b

  • SHA512

    cf389f6aa69071ac8127423265c63d249ba65a31588ae311aa7e772b9cd52fc68502f99e26ab95f8b0752fd1bf3217c7559a754e045eb2c0ade092ce65c69ed9

  • SSDEEP

    1536:RYPNV+vCwVXl9QrOaudpoff//qYba+1mtadAtO8duKTXEq:RMNBwVLQrOawEvBbLhoO8d7XEq

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Drops startup file

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1