Extracted

• • Target

    now.exe

  • Size

    142KB

  • MD5

    a0d7ef878665100044cd1d67df924e2b

  • SHA1

    31fadc994844a9e59bea9e52b193df3a8a39c6c7

  • SHA256

    382795fea9086b171f12bd039398b822fbae9ca1fe1704d89ec1ea53bfb4d37a

  • SHA512

    784543b84f835ea3d30a0b02d4f5ed558359c812d69c2921e0c8822cceabce0a2f935787154ba8d824c30eb34a75080ace598cd8f8df15fdb50c0ce5daac38a7

  • SSDEEP

    1536:z2H+q7TOFShECxGJRiUFu9ocO+XctTEW:DvqUFu9ocO+8EW

  Score

  10^/10

  xwormdiscoveryrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2behavioral3behavioral4behavioral5behavioral6behavioral7behavioral8behavioral9