Extracted

• • Target

    NursultanAlpha.exe

  • Size

    75KB

  • MD5

    2ddd08162c20e92a6d4b3703e06ba3c9

  • SHA1

    3c6bae2a365046055a059f8093e97d9354eb760c

  • SHA256

    8482c4662f7a0eb238bc77da5797d584e5d70a7329d46e933d43419ffa543d14

  • SHA512

    6b43c427612e02cffedad02cd790fff23d53e59fdc7f1f14c60bad5dca4a85f5a53987530aae07cf7b477e544b84f45864353932d72fa90b9469c4895b081257

  • SSDEEP

    1536:fNjt+7kgroBkEsFfxROKsMpwbP/A/NRUGu6NOHBKz1EuH:9M7kHdsFfDOKfebP/Ak6OAz1/H

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1