Extracted

• • Target

    sadasdasdasdasdas.exe

  • Size

    42KB

  • MD5

    3137c79a207244b4ffd8f47a280d6946

  • SHA1

    3694dd6f44949f6bf681b8a69410118033fe0368

  • SHA256

    d326364bd2e12c39ccb4b775a800b1e52111debaf2cfff0d0c020e06de4bf0c1

  • SHA512

    e9362eeca845a3c7491dcb5824fbe282815cb15d343b9b5e7db8be609ec09dac0962d4536d582c3f845b31b33b7872d3be5e433aba75bbf3856136f2fd941e67

  • SSDEEP

    768:ie2H+qvxFTOGo7ZQumhPMCYWGNthRQJMeZIF+0C9o/HhpjO+hJPbCPt8:J2H+q7TOFShECzGJRiUFu9oZNO+nct8

  Score

  10^/10

  xwormdefense_evasiondiscoveryrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1