Overview

overview

10

Static

static

10

XWorm V3.1...nd.png

windows7-x64

1

XWorm V3.1...nd.png

windows10-2004-x64

3

XWorm V3.1...ox.dll

windows7-x64

1

XWorm V3.1...ox.dll

windows10-2004-x64

1

XWorm V3.1...er.bat

windows7-x64

5

XWorm V3.1...er.bat

windows10-2004-x64

1

XWorm V3.1...re.dll

windows7-x64

1

XWorm V3.1...re.dll

windows10-2004-x64

1

XWorm V3.1...ms.dll

windows7-x64

1

XWorm V3.1...ms.dll

windows10-2004-x64

1

XWorm V3.1...IP.dat

windows7-x64

3

XWorm V3.1...IP.dat

windows10-2004-x64

3

XWorm V3.1...or.dll

windows7-x64

1

XWorm V3.1...or.dll

windows10-2004-x64

1

XWorm V3.1...ro.wav

windows7-x64

1

XWorm V3.1...ro.wav

windows10-2004-x64

6

XWorm V3.1...or.dll

windows7-x64

1

XWorm V3.1...or.dll

windows10-2004-x64

1

XWorm V3.1...NC.exe

windows7-x64

10

XWorm V3.1...NC.exe

windows10-2004-x64

10

XWorm V3.1....1.exe

windows7-x64

1

XWorm V3.1....1.exe

windows10-2004-x64

1

XWorm V3.1...xe.xml

windows7-x64

1

XWorm V3.1...xe.xml

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XWorm V3.1 - Copy.zip

  • Size

    25.9MB

  • Sample

    230217-fqr3xsdd5y

  • MD5

    c0d364d924d1f2b643c4db300f4c351c

  • SHA1

    dd5f5e7492dcf0adc76b6e9973d14a2eb5335852

  • SHA256

    58e9508e363895165bee8892c9fde2c1048d2e000c44fd4bc2be739a37adfb92

  • SHA512

    222b3a6f6e43c0ee70ab5d16028efc14e8296ceb7a161e2fd24235b22550a76c4b4eb10d4a77af57af321818e5b7462acef812c0254cbb9933148ef3cd2191cc

  • SSDEEP

    786432:BhX23QgeyHx/kNtMozFa70GK2avXOMOLTVG1dDp51FXlF2jize:vX23QghREmma70P2avYudPu4e

Score
10/10
asyncratxenarmorpasswordpersistenceratrecovery

Malware Config

Targets

    • Target

      XWorm V3.1 - Copy/Background.png

    • Size

      17KB

    • MD5

      a466fc11f42a6de40e050c9813947612

    • SHA1

      81845f1a0a98f590d97670c19d0a762123a2a539

    • SHA256

      5047dc90d705a1a50c325fc00b26d5290939c42d6aa727d09e8d21d0537cec85

    • SHA512

      59e3349a9291abe96c663e2f63345ea13c79e9a8a716a9408e74526f05642f1a8d59cc5ae866287299a4aa4a4fb8385f509de0d2dab483ffa6859a6a29c24556

    • SSDEEP

      192:lCxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxp:s2wDZijJE+w2QIfGR

    Score
    3/10
    behavioral1behavioral2

    • Target

      XWorm V3.1 - Copy/FastColoredTextBox.dll

    • Size

      333KB

    • MD5

      b746707265772b362c0ba18d8d630061

    • SHA1

      4b185e5f68c00bef441adb737d0955646d4e569a

    • SHA256

      3701b19ccdac79b880b197756a972027e2ac609ebed36753bd989367ea4ef519

    • SHA512

      fd67f6c55940509e8060da53693cb5fbac574eb1e79d5bd8f9bbd43edbd05f68d5f73994798a0eed676d3e583e1c6cde608b54c03604b3818520fa18ad19aec8

    • SSDEEP

      6144:4FErOIif3RzSHh+20lXs1TzCeBcQeDbNlz7:eEeR52bmeh0n

    Score
    1/10
    behavioral3behavioral4

    • Target

      XWorm V3.1 - Copy/Fixer.bat

    • Size

      122B

    • MD5

      2dabc46ce85aaff29f22cd74ec074f86

    • SHA1

      208ae3e48d67b94cc8be7bbfd9341d373fa8a730

    • SHA256

      a11703fd47d16020fa099a95bb4e46247d32cf8821dc1826e77a971cdd3c4c55

    • SHA512

      6a50b525bc5d8eb008b1b0d704f9942f72f1413e65751e3de83d2e16ef3cf02ef171b9da3fff0d2d92a81daac7f61b379fcf7a393f46e914435f6261965a53b3

    Score
    5/10

    • Drops file in System32 directory

    behavioral5behavioral6

    • Target

      XWorm V3.1 - Copy/GMap.NET.Core.dll

    • Size

      2.9MB

    • MD5

      819352ea9e832d24fc4cebb2757a462b

    • SHA1

      aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11

    • SHA256

      58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86

    • SHA512

      6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a

    • SSDEEP

      49152:ot12Gb/hz7ZsK9qY5uyUW57VC4IB1+fXhQ1hyCzMw/22fSg7gjxhUE/nbTC0xemh:oLbteKb57W1+PhQ1HM1gmJ/SZmh

    Score
    1/10
    behavioral7behavioral8

    • Target

      XWorm V3.1 - Copy/GMap.NET.WindowsForms.dll

    • Size

      147KB

    • MD5

      32a8742009ffdfd68b46fe8fd4794386

    • SHA1

      de18190d77ae094b03d357abfa4a465058cd54e3

    • SHA256

      741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365

    • SHA512

      22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b

    • SSDEEP

      3072:k1GmgYqIY/0YSDBRGlDUqL63budipxj64m8HWYh3vHbFwMhLJSb+:lIO6rGloqL63qW62lJ

    Score
    1/10
    behavioral10behavioral9

    • Target

      XWorm V3.1 - Copy/GeoIP.dat

    • Size

      1.2MB

    • MD5

      8ef41798df108ce9bd41382c9721b1c9

    • SHA1

      1e6227635a12039f4d380531b032bf773f0e6de0

    • SHA256

      bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740

    • SHA512

      4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b

    • SSDEEP

      24576:0L/59ah0USm3uwl00odi9AnW1fUmdbxv6bA3wOzRAc3InsZLONMrZb:+/59a6USdi9Ues6bV6boLO6rZ

    Score
    3/10
    behavioral11behavioral12

    • Target

      XWorm V3.1 - Copy/IconExtractor.dll

    • Size

      10KB

    • MD5

      640d8ffa779c6dd5252a262e440c66c0

    • SHA1

      3252d8a70a18d5d4e0cc84791d587dd12a394c2a

    • SHA256

      440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2

    • SHA512

      e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32

    • SSDEEP

      192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl

    Score
    1/10
    behavioral13behavioral14

    • Target

      XWorm V3.1 - Copy/Intro.wav

    • Size

      1.7MB

    • MD5

      dc28d546b643c5a33c292ae32d7cf43b

    • SHA1

      b1f891265914eea6926df765bce0f73f8d9d6741

    • SHA256

      20dcc4f50eb47cafda7926735df9ef8241598b83e233066ea495d4b8aa818851

    • SHA512

      9d8c1bb61b6f564044aad931e685387df9bc00a92ab5efe7191b94a3d45c7d98a6f71d8ae5668252d6a7b5b44ab6704464d688772aedac8bdb2773d5765d4d56

    • SSDEEP

      49152:a9ryN00SMMhAAtPU6elXXBjSdCEiV5Chuw4Osgplu:O30SnhAAtPTelHB7EiVfO7s

    Score
    6/10

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral15behavioral16

    • Target

      XWorm V3.1 - Copy/SimpleObfuscator.dll

    • Size

      1.4MB

    • MD5

      9043d712208178c33ba8e942834ce457

    • SHA1

      e0fa5c730bf127a33348f5d2a5673260ae3719d1

    • SHA256

      b7a6eea19188b987dad97b32d774107e9a1beb4f461a654a00197d73f7fad54c

    • SHA512

      dd6fa02ab70c58cde75fd4d4714e0ed0df5d3b18f737c68c93dba40c30376cc93957f8eef69fea86041489546ce4239b35a3b5d639472fd54b80f2f7260c8f65

    • SSDEEP

      24576:FDy7cKOfkiRrXP5WtJvW1mpjSWr7uoZme1V86:+8/AtJes1LJ

    Score
    1/10
    behavioral17behavioral18

    • Target

      XWorm V3.1 - Copy/XWorm HVNC.exe

    • Size

      50KB

    • MD5

      e11b0d5c1b597b014dfc2aeccb8eaf9e

    • SHA1

      c13e391e72374817061d3e27a4fbbb6d26e485f1

    • SHA256

      8b66826cc7573458e6993f1aee53f02f47be5ccbd8e97212c921f06c275acef3

    • SHA512

      b64f583bc0fbbd0ec0db25c0150f1a90a4743cdf15277129f4a3fefc910d431a4dfb5467f5791f66c4fe2acc528326d3e1d930ba8779cbde9673d4191817aa05

    • SSDEEP

      1536:s1fBubRKi+LHF99AFU6sOuGUdS1EAd8II0:siKi+LHF99AYOuJgEA6II0

    Score
    10/10
    asyncratpersistenceratxenarmorpasswordrecovery

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • XenArmor Suite

      XenArmor is as suite of password recovery tools for various application.

      recoverypasswordxenarmor

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral19behavioral20

    • Target

      XWorm V3.1 - Copy/XWorm V3.1.exe

    • Size

      6.9MB

    • MD5

      37a9fdc56e605d2342da88a6e6182b4b

    • SHA1

      20bc3df33bbbb676d2a3c572cff4c1d58c79055d

    • SHA256

      422ba689937e3748a4b6bd3c5af2dce0211e8a48eb25767e6d1d2192d27f1f58

    • SHA512

      f556805142b77b549845c0fa2206a4cb29d54752dc5650d9db58c1bbe1f7d0fc15ce04551853fb6454873877dbb88bebd15d81b875b405cdcc2fd21a515820d3

    • SSDEEP

      196608:rLQ6B/XKUDz9NoUXJzUWi7MYjBVvo5/UV:3FlaU/9NZXJZinjB9oxg

    Score
    1/10
    behavioral21behavioral22

    • Target

      XWorm V3.1 - Copy/XWorm V3.1.exe.config

    • Size

      183B

    • MD5

      66f09a3993dcae94acfe39d45b553f58

    • SHA1

      9d09f8e22d464f7021d7f713269b8169aed98682

    • SHA256

      7ea08548c23bd7fd7c75ca720ac5a0e8ca94cb51d06cd45ebf5f412e4bbdd7d7

    • SHA512

      c8ea53ab187a720080bd8d879704e035f7e632afe1ee93e7637fad6bb7e40d33a5fe7e5c3d69134209487d225e72d8d944a43a28dc32922e946023e89abc93ed

    Score
    1/10
    behavioral23behavioral24

MITRE ATT&CK Enterprise v6

Tasks