Extracted

• • Target

    bad804436fdffd9399bff8fe714756b62e5b6506da2d5ab8cca56865d3d822d2

  • Size

    167KB

  • MD5

    182b050b7db65d4036ab030adaa255b0

  • SHA1

    5f7a4ee3c631e7fe4800aaa74cbc76d8f9a9c034

  • SHA256

    bad804436fdffd9399bff8fe714756b62e5b6506da2d5ab8cca56865d3d822d2

  • SHA512

    45724a6a5639fe35854cd63a7ff8769283dc1452d70458c51533ebbf89950ec91ca7896c5388e2ff722cde612f58b60f31630d67cd5dadbf25ee67ea52bedb46

  • SSDEEP

    3072:AvOGEcyb1zL9RzsOvfPITBz65/M6If+3Js+3JFkKeTn1:AJTybV9RtgTxBt25

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2