Overview

overview

10

Static

static

10

0f0b4d98f4...68.exe

windows7_x64

10

0f0b4d98f4...68.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    0f0b4d98f4b41948f43060d83b12cf9c995f4a425f376c8ae4e5836500df6268.bin
  • Size 49KB
  • Sample220126-szhxtsfbb8
  • SHA256 0f0b4d98f4b41948f43060d83b12cf9c995f4a425f376c8ae4e5836500df6268
  • MD5 SHA1 SHA512
Score
10/10
nwormdownloaderworm

Malware Config

Extracted

Family

  • nworm

Version

  • v0.3.8

C2

  • google8.ddns.net:1999

Mutex

  • 52889f08

Targets

    • Target
      0f0b4d98f4b41948f43060d83b12cf9c995f4a425f376c8ae4e5836500df6268.bin
    • Size 49KB
    • SHA256 0f0b4d98f4b41948f43060d83b12cf9c995f4a425f376c8ae4e5836500df6268
    • MD5 SHA1 SHA512
    Score
    10/10
    nwormdownloaderworm

    • NWorm

      A TrickBot module used to propagate to vulnerable domain controllers.

      wormdownloadernworm

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks