Extracted

• • Target

    yesyes.exe

  • Size

    80KB

  • MD5

    449e611da0d5ef79840415ae1ebbaf04

  • SHA1

    c722eba3fe33d7d7fbc89863951111ee772d5468

  • SHA256

    170f9a45c7c994855a1e9d00170d6bf2d9ad2531ca1ee2f88787ad8e74b02012

  • SHA512

    e310c3206b27b7ec43b80685e4252e40d109efdf3684dd4d05cd2e6543dfe482ff03645a8bbec5a95444edb1d02687621249ea3127997cdae10d1e0ffabdb661

  • SSDEEP

    1536:yBIjlV6Gh32ecpdVm/vxT4OpDNmJuUqxb7lPqinX75z6lKa2OZkn1awK7Gq:y2jlid4x4y8grb75/X75KKa2OKn8Gq

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1