General

  • Target

    d9e0e8462d3d151c5f0179452dfca015d3ea13ca958d5b18abcbbe5d7907a7a2.bin

  • Size

    16KB

  • Sample

    220126-r9zsnaebaq

  • MD5

    a334f17c3c5cd82a43480d74d7cd2f42

  • SHA1

    bb00cbbb1114e7d002c8f03156760ce264160489

  • SHA256

    d9e0e8462d3d151c5f0179452dfca015d3ea13ca958d5b18abcbbe5d7907a7a2

  • SHA512

    5a517b19467422b8ff34c973d9b695ab81d175e9e4625825f4c95890f15eae82acff5298fb6a67752c1e1b71d4dbbacad5b155fc248595d151ac0aad9be1520e

Score
10/10

Malware Config

Extracted

Family

nworm

Version

v0.3.8

C2

34.176.64.245:1234

gamers2020.ownip.net:1234

Mutex

af517389

Targets

    • Target

      d9e0e8462d3d151c5f0179452dfca015d3ea13ca958d5b18abcbbe5d7907a7a2.bin

    • Size

      16KB

    • MD5

      a334f17c3c5cd82a43480d74d7cd2f42

    • SHA1

      bb00cbbb1114e7d002c8f03156760ce264160489

    • SHA256

      d9e0e8462d3d151c5f0179452dfca015d3ea13ca958d5b18abcbbe5d7907a7a2

    • SHA512

      5a517b19467422b8ff34c973d9b695ab81d175e9e4625825f4c95890f15eae82acff5298fb6a67752c1e1b71d4dbbacad5b155fc248595d151ac0aad9be1520e

    Score
    10/10
    • NWorm

      A TrickBot module used to propagate to vulnerable domain controllers.

MITRE ATT&CK Matrix

Tasks