Extracted

• • Target

    windowsUI.exe

  • Size

    64KB

  • MD5

    33a8c011ebe78a5743b06699f91791e4

  • SHA1

    4042168adabda1ac2b3c616c20a549f4babebaa9

  • SHA256

    37f1f16fafae0e4cb2f80d5e30135b8dcaf054facc3f978ae341ac9e0107b5b6

  • SHA512

    f1154e22759b7eb2c8a0742dd2eb832e4333491c55ef85d4c7de033e9a377b7f063ed656816bee9601c6279dbd1d91bb9bd07a0fe95aed22cd066227fc6e1b1a

  • SSDEEP

    1536:i+mw7o1xXClYExOz6yybwMJRkHodIgpywOOFNgzN:/mLLSfO9ybwbGISywOAQ

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2