Extracted

• • Target

    090.exe

  • Size

    175KB

  • MD5

    db8894bf4ce76e35b2004521848994e9

  • SHA1

    d5fc3440aa26b21ad26a20bcac88e969aec2811b

  • SHA256

    5caf9a48b1ddfa68af323d973dab2689f8e53e1d5260cd26133f98f0a110120a

  • SHA512

    533001155dfcd0c343ece9b4e3c849fe00d995d1eea90ecadb55474f7ce114a6b0283c441b76adf6eeef15c860e987f6a8aba29a42cb5fbc85b7dbf8f14839e0

  • SSDEEP

    3072:+eKdWXjObksahJ5YBVJOo+ZhxBz65/M6If+3Js+3JFkKeTn4:ZOWXjObkL/AUxBt25

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2