Extracted

• • Target

    yakudza.exe

  • Size

    70KB

  • MD5

    bf68e000b5ab48e8aedffa6f03ea60ba

  • SHA1

    2cfd70f8c977ffe04a5fc099f4b5a8b78851d7c7

  • SHA256

    6f07487577c737224626752ad4517d328d949caed1d4be7d21c78bc9e1226538

  • SHA512

    73a3c6e1814c0c55e8b30a66b23c1a6937bc1ba92623c802b86a72bea7b6f3928d28d18bdd113a9a22c1d06e78df61290d8a5e9de6215f616531cbae1947f656

  • SSDEEP

    1536:oMQw9GaJOV6s/guvtAp4I4bihXdkP6pJzOx05lkX2OY:oMP9G+0BR44bi5dkyJzOx05xOY

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1