xworm | 479d3fbea1ab6818d3ddf15d99d97b156f201c0854a2105e6c67310da172ac52 | Triage

Sharing

General

Target

svchost.exe
Size

44KB
Sample

230328-ds69hsae8t
MD5

e016d998cc83a07d7f527e2f2663c203
SHA1

ab620f5013ff3e035cd9adfbbd0fa39e6fe8e28c
SHA256

479d3fbea1ab6818d3ddf15d99d97b156f201c0854a2105e6c67310da172ac52
SHA512

914c3898c90b96812de904b923d27c6b70693b04ff6f09b74dcd7ddf846516927346c129b0b6503cb7867238c796f8ca4ec203e9bafb4ebba75019c769722047
SSDEEP

768:m3dZKcQ8A5MJqM+czV8+PR7hOP2qU3PQhLOSwo8/69j:EstkquzVfvO281O88/69j

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

C2

license-donna.at.ply.gg:55049

Mutex

vPxQcY5x2JutoRz0

Attributes

install_file
USB.exe

aes.plain

Targets

- Target
  
  svchost.exe
- Size
  
  44KB
- MD5
  
  e016d998cc83a07d7f527e2f2663c203
- SHA1
  
  ab620f5013ff3e035cd9adfbbd0fa39e6fe8e28c
- SHA256
  
  479d3fbea1ab6818d3ddf15d99d97b156f201c0854a2105e6c67310da172ac52
- SHA512
  
  914c3898c90b96812de904b923d27c6b70693b04ff6f09b74dcd7ddf846516927346c129b0b6503cb7867238c796f8ca4ec203e9bafb4ebba75019c769722047
- SSDEEP
  
  768:m3dZKcQ8A5MJqM+czV8+PR7hOP2qU3PQhLOSwo8/69j:EstkquzVfvO281O88/69j
Score

10^/10

xworm rat trojan
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1