Overview

overview

10

Static

static

10

5f1d35fe95...a1.exe

windows7_x64

10

5f1d35fe95...a1.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5f1d35fe95b85be2a3e915ee129ce6be0a319862552531153ba2add857298ca1.bin

  • Size

    16KB

  • Sample

    220126-szmk1seegm

  • MD5

    1877e11f2275162a996cf5a238d0ff99

  • SHA1

    d9646b2daaca30b4c27e7bd242e0fe5e5737f7cc

  • SHA256

    5f1d35fe95b85be2a3e915ee129ce6be0a319862552531153ba2add857298ca1

  • SHA512

    7510938c9935e848cec62e2a802478a0a831ef99c26d7fea7488f086f488256772aabf763d30e869858a6b4ec57d7fdddcba5f8b200242ae8c1caaaec3b94c9c

Score
10/10
nwormdownloaderworm

Malware Config

Extracted

Family

nworm

Version

v0.3.8

C2

desdemone.ddns.net:4444

Mutex

360d7948

Targets

    • Target

      5f1d35fe95b85be2a3e915ee129ce6be0a319862552531153ba2add857298ca1.bin

    • Size

      16KB

    • MD5

      1877e11f2275162a996cf5a238d0ff99

    • SHA1

      d9646b2daaca30b4c27e7bd242e0fe5e5737f7cc

    • SHA256

      5f1d35fe95b85be2a3e915ee129ce6be0a319862552531153ba2add857298ca1

    • SHA512

      7510938c9935e848cec62e2a802478a0a831ef99c26d7fea7488f086f488256772aabf763d30e869858a6b4ec57d7fdddcba5f8b200242ae8c1caaaec3b94c9c

    Score
    10/10
    nwormdownloaderworm

    • NWorm

      A TrickBot module used to propagate to vulnerable domain controllers.

      wormdownloadernworm
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks