Extracted

• • Target

    c979834586b0583152ead69d178431a2614db5423c735fd69d3a066d7fb06af5.exe

  • Size

    41KB

  • MD5

    9355120710b23d224c012b21fcd66648

  • SHA1

    1e15778184fac90344091a28275f16a0e315c1c0

  • SHA256

    c979834586b0583152ead69d178431a2614db5423c735fd69d3a066d7fb06af5

  • SHA512

    882a02dcfe48581547c4a2784b6c8d3cdfc990ec4d61f906d10d1616ebe1ea73a9b8b3cf835520a964addd1659c2d8e0c8c5a831a726abda5ee643ffa8ca891b

  • SSDEEP

    768:IhvGkOK5lJMU1BaeLCAr43M4fJF5Pa9p+CLq6iOwh1A3/mbLr:IZzZ5lR14URrcRF49ICLq6iOwzw+Pr

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2