Extracted

• • Target

    91e36194bc1caf8580ad6f4c697f4086b7bc49ded8b05b8d379997c465d2ba83

  • Size

    253KB

  • MD5

    fd2201497c2a985bc0f86a069d534fb3

  • SHA1

    4e2f1ac07162e37beb62ae297bcb579f0ef91020

  • SHA256

    91e36194bc1caf8580ad6f4c697f4086b7bc49ded8b05b8d379997c465d2ba83

  • SHA512

    d3c66780b55b42437ae6ffdc6a9a5d654534db0a026aad2b8d6d0ca85d7ce9a92c507e8e5e5b11e5de6fe7243abf8ff0d59483397d80f50492f7ae402f4c632a

  • SSDEEP

    6144:QfXT5QBy680QyttI+5v1BNWP9dQPmZMYuFZmGS2:Jd8CttXUQPmiYuHX

  Score

  10^/10

  xwormdiscoveryrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2