General

  • Target

    7f25334c4f94acfec2c0dec4626eedcb4d9c5923c411617de9663715d342e943.bin

  • Size

    16KB

  • Sample

    220126-r9xcjaeeg8

  • MD5

    27f4a53d7c1dbfb928b8174974787d6d

  • SHA1

    a2a007bb93c208da01dcf181c3bd29c40a582ce5

  • SHA256

    7f25334c4f94acfec2c0dec4626eedcb4d9c5923c411617de9663715d342e943

  • SHA512

    3c5335aa8ab4612ef34a0c8c15916237234ac78d2ec59f5152a86f3db02e1f236ea5752c444cccd957d163ded2a771d432af2f91e5978035343d7354f649ff46

Score
10/10

Malware Config

Extracted

Family

nworm

Version

v0.3.8

C2

n-worm.duckdns.org:4094

Mutex

1e333a7a

Targets

    • Target

      7f25334c4f94acfec2c0dec4626eedcb4d9c5923c411617de9663715d342e943.bin

    • Size

      16KB

    • MD5

      27f4a53d7c1dbfb928b8174974787d6d

    • SHA1

      a2a007bb93c208da01dcf181c3bd29c40a582ce5

    • SHA256

      7f25334c4f94acfec2c0dec4626eedcb4d9c5923c411617de9663715d342e943

    • SHA512

      3c5335aa8ab4612ef34a0c8c15916237234ac78d2ec59f5152a86f3db02e1f236ea5752c444cccd957d163ded2a771d432af2f91e5978035343d7354f649ff46

    Score
    10/10
    • NWorm

      A TrickBot module used to propagate to vulnerable domain controllers.

MITRE ATT&CK Matrix

Tasks