Overview

overview

10

Static

static

10

4b9d11ad0a...22.exe

windows7-x64

10

4b9d11ad0a...22.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8682c4dc2e3ae57079e9ada0943b813d.bin

  • Size

    39KB

  • Sample

    230319-wk8rgsbf3z

  • MD5

    c8a23267f3c93514510f4ad7989e0741

  • SHA1

    64e136ac4818fd5ced89ab59a0c545ec5240603c

  • SHA256

    0170f0bd93233b85242d349965a490f12427a620e319d120b8064ff1516eb33f

  • SHA512

    0ec007dfecc8015bd2d9d3e6a9f819b2e97b577c8bd70ee148488cb6aaf23e09733aecdcc4bd4bc6be2064690f196edc7fd666c26088c41e27db23edf0eb7c43

  • SSDEEP

    768:Jih4RiVKT3m5Ft91v2v0pcAdgckwGXIyfRW7GUCNEkAv1kREr2WSzEkoEY:s4RD3m5FpOwcpcsVfYW3AtAi2VECY

Score
10/10
xwormpersistencerattrojan

Malware Config

Targets

    • Target

      4b9d11ad0a32fd2d76d4d8e9256f13df37b7628df9eb50b21dd11016d0a4ca22.exe

    • Size

      66KB

    • MD5

      8682c4dc2e3ae57079e9ada0943b813d

    • SHA1

      d855ac963756f24d67297c1c9b94b86d6e5350ba

    • SHA256

      4b9d11ad0a32fd2d76d4d8e9256f13df37b7628df9eb50b21dd11016d0a4ca22

    • SHA512

      a7eb2a5db32d0b96e0bc761454bf9bc40bde24ff8a6eab52c799d6438c2e64d1b0fb914a75b34256e488f76b9ec7423eea82537a772f599b8e02e8199c8e5ace

    • SSDEEP

      1536:Yd077VI2kTksimD7A9sb0sBmaOu8EJSRK:Z9kT5imD7Osb0umaOuxGK

    Score
    10/10
    xwormpersistencerattrojan

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks