Extracted

• • Target

    conhost.exe

  • Size

    71KB

  • MD5

    7fd47d1198c863ec2190ef7e39d53555

  • SHA1

    b96a4dfab86e26d70af5f8618ac646b272385e74

  • SHA256

    0052f49f6088308302f0a099ac7f89a512011136232bbda7cbd15721c2a48b1d

  • SHA512

    ca569e2a161c492d3f2831bf2e163fd9fa363f481f64af8b233cfdc324e39dbf61925e18d67743d916517d182c4b16351ae5c9f36bc7ed1f7a073a7b11384b45

  • SSDEEP

    1536:eXC7z+yH7qVMYl/Ce2WsW2Zdb5opKyIAaOQoDxqS:emP+Bybb5Ry8OQon

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2