Extracted

• • Target

    48f18ae61538c79d3d5ab7663c621b6d08e0f6413d6c7c13b10dc12a7c6027cf.exe

  • Size

    76KB

  • MD5

    781a598560272296fa31f3f936c02cc7

  • SHA1

    b2ffa56d82455ee07ae4614619fb98a98a6f1a76

  • SHA256

    48f18ae61538c79d3d5ab7663c621b6d08e0f6413d6c7c13b10dc12a7c6027cf

  • SHA512

    b17dbd705b6a7e58855839625484a073b36ecaa5cb9520e4f857f964b13c0b8b609e7e7f67d4873e70e2ef753630b314d9607338cc048a249db55fb0dbaa6e23

  • SSDEEP

    1536:SAArKmiQ6kQVEX2VBxoPsSxYTbA2jPntlL1vsUCtsA+OmPq8vxED:S/r7QHvxusCYTbAofbhvs3sJOmvG

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2