Extracted

• • Target

    SecurityHealthSystray.exe

  • Size

    251KB

  • MD5

    a7209832f2c21ce4c6e351b1f1d4749c

  • SHA1

    5849477602755a1a2be4fc2a8a395dc8f523fc07

  • SHA256

    b5ed60d7bda3cfe44a7397c5378ed4bce4f8a700508835a4b58169a74e355ea8

  • SHA512

    912f4355fa7c64d5da527d7b7ed3389690c39a6fa89192efc5a8093d4425f00f47c2ecd182f86df720d9c3b471a34ec659235ad35780a794cfa2ebe065220ea1

  • SSDEEP

    6144:mgatb2wv2iTVVmVVV8VVNVVVcVVVxVVVPVVlVVVRVVVtVVWV60jVLVVOVVUVZVVS:na0w9

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2