Overview

overview

10

Static

static

10

first_pe.exe

windows7_x64

10

first_pe.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    first_pe.exe

  • Size

    16KB

  • Sample

    220224-zjvd9adfd3

  • MD5

    634838d7ec50a75a81bc3905a511f0ff

  • SHA1

    c5f90d1cc2ca7f09d1d7e176d6f3976fa7e2f803

  • SHA256

    0e55b242204c6234c1c43f105f4c6083b6fa8653ecd4039a927eb23d739324b1

  • SHA512

    1d0a36919dd27daf31bd6c4d6e27f149b0e0f0bf60e3f871d20ed6e733be5ef2be2c247ca1514c5ff752bf6f1fe5a8f5319e0dc6d051ced84516c8a1e2a41176

Score
10/10
nwormdownloaderworm

Malware Config

Extracted

Family

nworm

Version

v0.3.8

C2

nyanmoj.duckdns.org:5057

moneyhope81.duckdns.org:5057
Mutex

cb2d3cba

Targets

    • Target

      first_pe.exe

    • Size

      16KB

    • MD5

      634838d7ec50a75a81bc3905a511f0ff

    • SHA1

      c5f90d1cc2ca7f09d1d7e176d6f3976fa7e2f803

    • SHA256

      0e55b242204c6234c1c43f105f4c6083b6fa8653ecd4039a927eb23d739324b1

    • SHA512

      1d0a36919dd27daf31bd6c4d6e27f149b0e0f0bf60e3f871d20ed6e733be5ef2be2c247ca1514c5ff752bf6f1fe5a8f5319e0dc6d051ced84516c8a1e2a41176

    Score
    10/10
    nwormdownloaderworm

    • NWorm

      A TrickBot module used to propagate to vulnerable domain controllers.

      wormdownloadernworm
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks