xworm | 2465292038537dbec604a8a9190376d62c28d9ec2efe1726af2f9e6f4a3b0287 | Triage

Sharing

General

Target

tmp
Size

371KB
Sample

230325-hszlwsbe87
MD5

7beb08458c549d96b4e8faf13d85291e
SHA1

022ce3a19e0ee90e802793df14e3269b5aadb6c0
SHA256

2465292038537dbec604a8a9190376d62c28d9ec2efe1726af2f9e6f4a3b0287
SHA512

6bf7833e0e9008fd274a89c8ad531213a1e7180103f33749282c921a1b9f36f8661483092deb4c2fddd65f2116b939c7c21038ecbfe2cfb1bdc78307e91a07d2
SSDEEP

6144:+1+LrUmN2pf1eHdUtqxhzIdOxtkTy+QzcZIINaBhhFA8SaDrDc4XpfnnnYki34P/:+5Cgqxhkcxt27QzUIvo8s2bSCi

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

C2

62.171.178.45:7000

Mutex

tDbp1EmAkvM7wf10

Attributes

install_file
USB.exe

aes.plain

Targets

- Target
  
  tmp
- Size
  
  371KB
- MD5
  
  7beb08458c549d96b4e8faf13d85291e
- SHA1
  
  022ce3a19e0ee90e802793df14e3269b5aadb6c0
- SHA256
  
  2465292038537dbec604a8a9190376d62c28d9ec2efe1726af2f9e6f4a3b0287
- SHA512
  
  6bf7833e0e9008fd274a89c8ad531213a1e7180103f33749282c921a1b9f36f8661483092deb4c2fddd65f2116b939c7c21038ecbfe2cfb1bdc78307e91a07d2
- SSDEEP
  
  6144:+1+LrUmN2pf1eHdUtqxhzIdOxtkTy+QzcZIINaBhhFA8SaDrDc4XpfnnnYki34P/:+5Cgqxhkcxt27QzUIvo8s2bSCi
Score

10^/10

xworm rat trojan
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2