Overview

overview

10

Static

static

10

fleint.exe

windows7-x64

10

fleint.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fleint.exe

  • Size

    66KB

  • Sample

    230317-rc6vpsae61

  • MD5

    8682c4dc2e3ae57079e9ada0943b813d

  • SHA1

    d855ac963756f24d67297c1c9b94b86d6e5350ba

  • SHA256

    4b9d11ad0a32fd2d76d4d8e9256f13df37b7628df9eb50b21dd11016d0a4ca22

  • SHA512

    a7eb2a5db32d0b96e0bc761454bf9bc40bde24ff8a6eab52c799d6438c2e64d1b0fb914a75b34256e488f76b9ec7423eea82537a772f599b8e02e8199c8e5ace

  • SSDEEP

    1536:Yd077VI2kTksimD7A9sb0sBmaOu8EJSRK:Z9kT5imD7Osb0umaOuxGK

Score
10/10
xwormpersistencerattrojan

Malware Config

Targets

    • Target

      fleint.exe

    • Size

      66KB

    • MD5

      8682c4dc2e3ae57079e9ada0943b813d

    • SHA1

      d855ac963756f24d67297c1c9b94b86d6e5350ba

    • SHA256

      4b9d11ad0a32fd2d76d4d8e9256f13df37b7628df9eb50b21dd11016d0a4ca22

    • SHA512

      a7eb2a5db32d0b96e0bc761454bf9bc40bde24ff8a6eab52c799d6438c2e64d1b0fb914a75b34256e488f76b9ec7423eea82537a772f599b8e02e8199c8e5ace

    • SSDEEP

      1536:Yd077VI2kTksimD7A9sb0sBmaOu8EJSRK:Z9kT5imD7Osb0umaOuxGK

    Score
    10/10
    xwormpersistencerattrojan

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks