Extracted

• • Target

    Chef.exe

  • Size

    2.4MB

  • MD5

    913746cb80b7853cc2430a0c067a2d4c

  • SHA1

    7cfaf2942ac5aef5d73dc93e53d93eaaea673e87

  • SHA256

    9e109f42594b27b9cd46bc2c921467e571ded77081b8827717dee1a63d454703

  • SHA512

    943ef904a4fe28ef265a1556890002049fbf57f8992f5e8b60c09668ecab2310ab252b140331615c2be910cd5f3edd65544ee63c12651c8db398b6e91ac2c644

  • SSDEEP

    49152:TL4Lbjy9eBZGXfdEl6ISzae0PF81yQYZ0yKAA6M8AAk1+ycDyJ8siSDt8:TESeD0Vs6ISx0dPQNy2ady/J8siSR8

  Score

  10^/10

  xwormdiscoveryrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1