Extracted

• • Target

    4d9fb14e15d1613a7a5d70efbacb0f153729f02216116c3f7f117b033bd7655c.exe

  • Size

    36KB

  • MD5

    f55d89f82515bde23bb272f930cb9492

  • SHA1

    666d0f5a98f03292abf16cd2de599997c836926a

  • SHA256

    4d9fb14e15d1613a7a5d70efbacb0f153729f02216116c3f7f117b033bd7655c

  • SHA512

    a7a62daf90aae27207b77034e8a76d5b3f8aa05430bd8768d46be7f3843962ddc1ef154691dc0f26051605fbb36269e59f18c3c75fdf72222346188e7a6cf03b

  • SSDEEP

    384:/IFAz8mqQNv9qNx7kKka/sVxCTjMBVJYX7+u91X5Lj6WmyyNApPzuSvZ5mpkFyHZ:EApN1/qEMFj60y+hLFyT9CCOjhyPy2B

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Drops startup file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2