Extracted

• • Target

    FNExternal.exe

  • Size

    86KB

  • MD5

    7dc43a52c140117ec3a23b8f78496f0f

  • SHA1

    1c7c2697d12df0398fcb089853a1b5789f3ae887

  • SHA256

    820d57a6faa4134e63df8bba8638792b55a7fe3c77559812706cd7de4da189b6

  • SHA512

    95898e739ead059e06531367a0c5ca5c630ed1f16a2a2c36cada8b7a94d4fe81f7486ab7ef720da1ae09169c08fc32aa64fb4a5554a5779095400582bcaaf3be

  • SSDEEP

    1536:N20YwopvrUvr0wMTwjqWJZiCbJVjWTDpJO960azDAOuymZp+X:BYZpAvgwMm5iCbJCSO5mZ8X

  Score

  10^/10

  xwormdiscoveryrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2