Extracted

• • Target

    401d3bc82fc9b3bae9e8a1cc304945be8d2ef546d50c7d89c511444969e07a4f.exe

  • Size

    205KB

  • MD5

    f81000258a9d6b304be9df8c12f076ab

  • SHA1

    6a7c3aecca9bdcba796390fb566f173f84d7dffa

  • SHA256

    401d3bc82fc9b3bae9e8a1cc304945be8d2ef546d50c7d89c511444969e07a4f

  • SHA512

    4c7f643aaa3f2c608ec0f4d276e2808c6af814b5fca69d13d886760c395a27752d6b5823d7c6f0f7021fad60d98b9aa6fda0e62c97306b37984aa348c83b42df

  • SSDEEP

    3072:hyD3jQEa4CFv95kOMS8SKfbzxcwg7es6/Vsb8VKTup49oJMfF/H9N3Ky9NzLnk:40Eav9rUhcX7elbKTuq9bfF/H9d9n

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2