Extracted

• • Target

    Ragnarok.exe

  • Size

    64KB

  • MD5

    ca2ca3a59f582707019ea3329622e265

  • SHA1

    52f7b8ec3a5113c973cfda5144fba0b18cf1eea1

  • SHA256

    bd8566a62ba1230c67f5e361dfee355986f73962253fe60bb25993982b86a2f8

  • SHA512

    4ffb989aeb88304791dde7b4502f2d70f1fd97a460f0592c4b96216a7b8a4d7ec9bab562c901e33bb0f6895de37715bd15f37d64dc2cf87bf458f0d4c3e39ad7

  • SSDEEP

    1536:1cWMOGx/tszzts0MHbavfanDBbnCYcjn+AiEOgDjRF:1cWMOU2+HtDBbn3EOgRF

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1