Extracted

• • Target

    legit.exe

  • Size

    72KB

  • MD5

    2a7443d84bccaf9ab7f3aa033fb4e40c

  • SHA1

    e7c578350706edf3f6c576090d43445170197c37

  • SHA256

    937caa32d2f1d782e1618f57feaf5b82f66ff3e2c111d6a58b75038b5fa76b0e

  • SHA512

    214f31711d5743214ca6847a15f959708bc46686060340409d391d742cd0107febf942568fe909cd5bd4e931dab33860f1704e87e5fbbef3da05e4b0e2b96dc4

  • SSDEEP

    1536:k0Q0pawybM+jJwSeBxbDpA6b8jOxI+2QKWGy:TcjUXbDX8jOxI+5Gy

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1