Extracted

• • Target

    56479cbffa13a809a3b9ce1758c19e07fd06b5158e25b4a051bd27b9f6a9e837

  • Size

    445KB

  • MD5

    de0cb22f3e12a1a4f2c74b5ea0c64c96

  • SHA1

    db6fe1108787a9b87a0a312507acfbafb037eeec

  • SHA256

    56479cbffa13a809a3b9ce1758c19e07fd06b5158e25b4a051bd27b9f6a9e837

  • SHA512

    61b1d6df2a27e453e541a831b4466a091bbf0604eb1c20f8ce3ab26a2450a117bc45fab98787e1217e471e84eb7bfa5015409ba36fa689e9de97da1617c86d02

  • SSDEEP

    1536:Yx/gQuRHBNUwouYbSREFrqWV1bQyKbupo6tZOZ1IaICEBidEiPMXe:u/gQulWOORbQpCJZOsaICEBziPQe

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2