Overview

overview

10

Static

static

10

Vbucks-gen.exe

windows7-x64

10

Vbucks-gen.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Vbucks-gen.exe

  • Size

    229KB

  • Sample

    240428-gyhd5ahh91

  • MD5

    6b8f6f416051d2947c802eeb3710077b

  • SHA1

    02f986ff007d5867d1d638f72c61e7231c0374d2

  • SHA256

    05026b12b16aa7ffb8aa35c47e1d967b17459eb313f443dfaffd528842df5ba2

  • SHA512

    0ea970a737ca8d49af5d1008eb254027d939aea1d98af5b8bdae2b092279c2420b1c52f49becda0f23f955e02fbf33c4a78af74935cf94743f553bad6db64480

  • SSDEEP

    3072:y85g8Zl3CCzlgJQmzcAkWENrrlKVAvYkzQfQj7oIhGwubdjdhO9dRgeX77fizS:jpZlSIWpqnloO9oqgbLsAeX3az

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

C2

192.168.0.197:9999

Mutex

7u0t4YhJyvkbGmU0

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      Vbucks-gen.exe

    • Size

      229KB

    • MD5

      6b8f6f416051d2947c802eeb3710077b

    • SHA1

      02f986ff007d5867d1d638f72c61e7231c0374d2

    • SHA256

      05026b12b16aa7ffb8aa35c47e1d967b17459eb313f443dfaffd528842df5ba2

    • SHA512

      0ea970a737ca8d49af5d1008eb254027d939aea1d98af5b8bdae2b092279c2420b1c52f49becda0f23f955e02fbf33c4a78af74935cf94743f553bad6db64480

    • SSDEEP

      3072:y85g8Zl3CCzlgJQmzcAkWENrrlKVAvYkzQfQj7oIhGwubdjdhO9dRgeX77fizS:jpZlSIWpqnloO9oqgbLsAeX3az

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks