Extracted

• • Target

    81e49f6ddc6313c511f10e6464db05edf86ee3c0613b056ae784416b7d23c192.exe

  • Size

    142KB

  • MD5

    fd0d3739d3763fea5b0131692f71f9d7

  • SHA1

    e23d14f8107411ed1f34214002df9adebeca4688

  • SHA256

    81e49f6ddc6313c511f10e6464db05edf86ee3c0613b056ae784416b7d23c192

  • SHA512

    3eb4e7922d64f42210679c467aa8693d0e707c6627e189d0654abb02da3669866adf007bf80aa205f76d6fd196e50152bfa04efa914878856d8fb03d61771b20

  • SSDEEP

    768:EG2ZOWZ42nxujIXvgggCLJF5PG9pm9X6vOwh03Emzk621sIwEk4w00wIn:EG2bZ42n0UXvvgcFI9Ah6vOwO9HEUn

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2