Extracted

• • Target
    Boostrapperv2.exe
  • Size 60KB
  • SHA256 568bebcc30d4bde6c78850bf27f78aaf828ebd1c3f8e32154e56e7a1ba3ef40d
  • MD5 07e9663ebb9dae3ae20990d7d06cfdd3
  • SHA1 3e0c059e9534ea027b84bbf1c147f7a0cc74725f
  • SHA512 7c7beb385c88468e0d0c790269fb95b519357bb6ed014f4118d416fa61955342cb19033d416b8434b2716a6378bbf99b0436384c974e3b2daaf71b79e2f0c33d
  • SSDEEP 1536:6o2bUdvJ/FzXvwlbXTjBz2I5POrVtIW0:52wHVvwlbX5KINOr7IW0
  • TLSH
    T1FC537C14BBE64221E2FE6FB55DB13263C774A7539813D61F18C940CA1B27AC9CE107E6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1