Extracted

• • Target

    apca.exe

  • Size

    72KB

  • MD5

    6350f6c27b55c5139fb548eb1d06b378

  • SHA1

    31fdff983dbc39ef1ec54012698016e43c8ae08e

  • SHA256

    cb92212116b930f4be446c46e5381b29900a21ee80bf208d65549a84077b7a28

  • SHA512

    6e038a21a9c565cc1668b51088990ddf48c012efe00b0bf87213509381ec8efc9af5f678632813801ada79af53d7004ea59e1a85e5f122d078e9c8ffbb5079b8

  • SSDEEP

    1536:PPnHXIvOk4fA5/7ZUOtYeYtAyCbvUFbN5L/GZDHdOSzJCAMIG:n3IviAbYntApbv8N49OSzJCSG

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1