Extracted

• • Target

    XClient.exe

  • Size

    76KB

  • MD5

    989838eaea4c2793ed52afe08619a1bd

  • SHA1

    d5c38be49c9b421a7402350231e47379b55a28ee

  • SHA256

    f4d6f0ed3c6037c49743c5b72c92d11ce96f356d7418a5146e58745e299eaff0

  • SHA512

    91dcb32d6c218a58858d5c7ff6109bfe608e642d273769aff710dbadf0ae110b5910747bb42dad19d9ecbea1c52a9d9c18c56adf56fb3b0d12cb3feaa461b2dd

  • SSDEEP

    1536:HUB4T9GSGm8M9AjmYkbKW/L/yHDLEGb69Iw9/OVYbVsHBz4:HUm4A9Ym7bKWeH3EmYOabVsH14

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2