Extracted

• • Target

    XClient.exe

  • Size

    76KB

  • MD5

    3814644750f4dc71eb4b57bb7cabe3df

  • SHA1

    3346103ea9ab119e2f097184e942a9350bf6be16

  • SHA256

    eb7d53d3c3c11ece53e57b6768dca1e9302c4ccd0ce584e9f21e4e18703ae561

  • SHA512

    cb12f15e0c113ecfaf9130d2c0f15f1bbc4a31cc17d10aa4b7bc2d58bb170d1dc33e86543827d89a656d5582228c1cdd1287a84c7ef93a88c79c6adfc0671cf4

  • SSDEEP

    1536:aClU1nxxmTdApSDGp5QdZqd/bsKYnQR+bkpv6lOrDFx:aClUx/L/YcbsKqQRIOrRx

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2