Extracted

• • Target

    MsMpEng.exe

  • Size

    73KB

  • MD5

    c10ed05ad6b6da082082307b9aee334b

  • SHA1

    321a8c4ba3edb1b7c652aeadb96c05485e8e5ffc

  • SHA256

    665a18b6ceed86e5bbeef6fcea46f9e047e26a14493d953b251a6bbdbb429539

  • SHA512

    0592bcef39abe7abda1338430ae0c157e5637b4d093c2db210a967d84e168d4c8cbe9872c803dcaa3aa626c068bbb3ed0b10a25e502e9b509444392a143a32f3

  • SSDEEP

    1536:knfTJbxJ5HP2Kd61ki95dbcftmf80bwXA6cAk53OswetbT:q/HPWNHdbcftmjcXHk53ODeJT

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2