Overview

overview

10

Static

static

10

XWorm-RAT-...ry.dll

windows7-x64

1

XWorm-RAT-...ry.dll

windows10-2004-x64

1

XWorm-RAT-...ne.dll

windows7-x64

1

XWorm-RAT-...ne.dll

windows10-2004-x64

1

XWorm-RAT-...ll.dll

windows7-x64

1

XWorm-RAT-...ll.dll

windows10-2004-x64

1

XWorm-RAT-...sk.dll

windows7-x64

1

XWorm-RAT-...sk.dll

windows10-2004-x64

1

XWorm-RAT-...ll.dll

windows7-x64

1

XWorm-RAT-...ll.dll

windows10-2004-x64

1

XWorm-RAT-...me.dll

windows7-x64

1

XWorm-RAT-...me.dll

windows10-2004-x64

1

XWorm-RAT-...ep.dll

windows7-x64

1

XWorm-RAT-...ep.dll

windows10-2004-x64

1

XWorm-RAT-...ey.dll

windows7-x64

1

XWorm-RAT-...ey.dll

windows10-2004-x64

1

XWorm-RAT-...ms.dll

windows7-x64

1

XWorm-RAT-...ms.dll

windows10-2004-x64

1

XWorm-RAT-...re.dll

windows7-x64

1

XWorm-RAT-...re.dll

windows10-2004-x64

1

XWorm-RAT-...nM.dll

windows7-x64

1

XWorm-RAT-...nM.dll

windows10-2004-x64

1

XWorm-RAT-...PE.dll

windows7-x64

1

XWorm-RAT-...PE.dll

windows10-2004-x64

1

XWorm-RAT-...pt.dll

windows7-x64

1

XWorm-RAT-...pt.dll

windows10-2004-x64

1

XWorm-RAT-...ET.dll

windows7-x64

1

XWorm-RAT-...ET.dll

windows10-2004-x64

1

XWorm-RAT-...ss.dll

windows7-x64

1

XWorm-RAT-...ss.dll

windows10-2004-x64

1

XWorm-RAT-...te.dll

windows7-x64

1

XWorm-RAT-...te.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XWorm-RAT-main.zip

  • Size

    34.8MB

  • Sample

    230331-vs7nqadc5w

  • MD5

    82ccb74455818f185b285bcfe0338c7d

  • SHA1

    e30b03aa4e431c7244145963871ab43419440415

  • SHA256

    f0eb7f58edc94075cf2d0567ad4b9c7153f7bdeca5e3537ee88360214f6a9076

  • SHA512

    ed9cd181d17aee8a40c128c8476439f8bd13ce4984881d852eca9f26dcd79e773b637893b4b96194cca866c6483d22ebd3eb762a07f1846dc2aa579b38d3dc6d

  • SSDEEP

    786432:1jVrlNnSWOwfT9SMQ+BpOspoclWQWBtDQXzTnHB35FyGIYyiIKe:hbVSwfhS4TOshANlWh35F/IMI

Score
10/10
agilenet

Malware Config

Targets

    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/Memory.dll

    • Size

      9KB

    • MD5

      b8345a39a0f6e6a65f05bb1370b66d1e

    • SHA1

      e416cfae4f709bfcf4b5f8e2b79775d462a161ef

    • SHA256

      23e5a0d72e31184d8a8769a2c02d7c94c6b75846436f76c511464c2c20ce8387

    • SHA512

      c6b33fc1841586e0371f46c72354de0aea64f8110a29a5c30836417e47c93bcc5d97ce3cc6faf0eecc44d4b9b2415e62e2a44fc52a69c045ced95e8bbb2cb275

    • SSDEEP

      192:iep14DC2HwQG8A1OQGOz714uOIW1fn/eK+QMLuJNyL2:iepuC2Hwv444uen/eK+QJNyL2

    Score
    1/10
    behavioral1behavioral2

    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/Microphone.dll

    • Size

      540KB

    • MD5

      8fe668835a897d92bdba015fc1cc8af5

    • SHA1

      25c6d6eeccf6d945176dc6f2ad051961b93a68cb

    • SHA256

      f1106739567a2184b5dc8aabed3603c51c65fdccdf6875d9077bad6dfb422da0

    • SHA512

      a3e75daeeb0b7a8524d214ff2c79dbdbf11c81f19f5d474243ea3b6b54ef238ad0be47d9d707e6f3f0986447a7291e17a41ee6ebad078807fedb6b996886e127

    • SSDEEP

      6144:OO1+opclCf2v6exF0SyqeDI28DjyUbfb78+smmnJsCEmBy2pYARdd3NbFXElNZQ:O6zpFuvrFKDIT7bgFueXh/FXElNYu

    Score
    1/10
    behavioral3behavioral4

    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/NetInstall.dll

    • Size

      9KB

    • MD5

      9d8b706fa483d4974cdfc9e806b2863e

    • SHA1

      700e319afc9f1ac197d8a2077b12fa44b6b34d60

    • SHA256

      afefaf064810b08003b93aa1bd702d4b0fb15de29194bb2479a35443537ed348

    • SHA512

      fe8e26b07ffb366eb59dd169da76bb881e16512cdc5e8f225043c1b487d9a08b2a256d3b5de52f3217a6348d57d48d554b3bced6aa6da85bc32f7b398b643b5f

    • SSDEEP

      192:6ZTrGU8N06k8TQOPPz+0EX6QGOou3gysxeIW1PnQ97KpfATL2spY:6ZPGxjk8d+0EX4physxAnQ97KpfBspY

    Score
    1/10
    behavioral5behavioral6

    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/Ngrok-Disk.dll

    • Size

      12.3MB

    • MD5

      ccfb289bf29889c43369bd2166c17412

    • SHA1

      525fe101583f9d9fa14d35c27c3e9b0b61940760

    • SHA256

      3b2735a924841ac27fdb239d637dc730ada783d3a673a97df2682869faf3087e

    • SHA512

      5f7df0d4fc02b24ac0777e4ea4d35794865dbea93a65d3b44fd828fa5253ab27f4d9413260f5235751c5fb551998e7c8da07b78abe27ec2ea287bf86af9442ec

    • SSDEEP

      196608:TKWRNtaaymwIm9CSiRmW2XDLj2k7AW2bx8rkjq/vEO6w/3EyVzgzqjD0w4JnZqq:TR3wazwc0W2X/9f8zjqHd33HD0w

    Score
    1/10
    behavioral7behavioral8

    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/Ngrok-Install.dll

    • Size

      384KB

    • MD5

      c0f9f255b8cd7a6155925877d0ba9f71

    • SHA1

      8187eb04ace363a20ccfba3afaeeeb96ac267276

    • SHA256

      4cfcb5c0664fe82bcbe8c6502745d8d813222d05047537a2f6071709a2acd51d

    • SHA512

      a4d7956f9de69537742c76d6e84c7a4c98ffcbb144515a334302653626af0722f511f12f82c488addb9688f6a6a110c2c4f703409196f002e157c09e120d6216

    • SSDEEP

      6144:nqqDLJmokuhmMe7+1VIc2G5Gh7LgWTiMhxUkUVW1xFmgI0yV:qqnwok8mMe7+1n2G5A7LbbhxcUDI0

    Score
    1/10
    behavioral10behavioral9

    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/Pastime.dll

    • Size

      18KB

    • MD5

      f8556ea3b1f1a3a7e9a640a1092a556b

    • SHA1

      1862722d6f56bd4e4ba82c35e51173c2cb839f19

    • SHA256

      765c7a88112ee3ad03bc92cc3da37840082d62746bd5b02bcb8a57d5145345ae

    • SHA512

      9dfde73863bf062e76be09a1e6aa104f8ded04f67654ec0e2af3dad705e7d0f912dd77d9eeb25ed9a4817856ee6082d6c21846a3496265b1fb24c1b02cab2ade

    • SSDEEP

      384:y/vgBKHr2RVeapLyY9KeTj1kn26vOia/mT+//BeVUJsA8/VHMQ:4vgBKHr2Kap+Y9KmG1Fy/BPeA8/VHF

    Score
    1/10
    behavioral11behavioral12

    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/PreventSleep.dll

    • Size

      9KB

    • MD5

      e6c51c9850b9e65368b94b4c6ee64c2e

    • SHA1

      45203f003cd009f369f0fc0cd1756ae66f49bde5

    • SHA256

      c568ab1ced62dda4047b101d321136a49356f082f3cf4afc2d5d1adf45c3adb3

    • SHA512

      909caee45d8f770b14f411cbd6e50cf17152258b5eacf27d8686b09cbf4ade0a452d996b8ff0e8a8a4f470ffff89709ab190f5d116c236c1dabcdac550d04df8

    • SSDEEP

      192:hbA4MnX0GOwav19TvIW1Pn/+8p4jTH/Luj:hFyX1ot9TJn/np4jej

    Score
    1/10
    behavioral13behavioral14

    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/ProduKey.dll

    • Size

      98KB

    • MD5

      e6f0cb7913c9c3f064f52f7407b5cc3b

    • SHA1

      87943989d2eb6cae45a06dc526f267c7b76f57b6

    • SHA256

      1edff19661db8d711a79adfb9c7d701aaf885d25d12d55bc804f0b6a5d49910c

    • SHA512

      4634584da3f8534e3b1b0941e1827ca926b74d68fb2cfa165ce4b19b2c5200bf99fbc8f724fff99c8de5ffa123927e44f633dd693e2d15c45f5a3ce1d915fcf3

    • SSDEEP

      1536:0mbucSAwsbzcvesvH29p9coCgSeX06hfKRXso2G9eUJxDbi0:Nb3SQ3cmsCXcovdX1TG9eU7/

    Score
    1/10
    behavioral15behavioral16

    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/Programs.dll

    • Size

      9KB

    • MD5

      4ab2e715a2549c938247d459dfcb33f5

    • SHA1

      ce0073699cc018e274e6d93a6a3c36bd0488576b

    • SHA256

      ed86bac895c455ccd61180f0664be0b0d99f011e90e319f97afeabc286f7838f

    • SHA512

      e68b10549fe86503c0b654b1477c22e69395f20b7c9ec208180c08cd5899964dc7f1e31c9c46cc4f63c1bd3a862ab74bce42cce9fa7443630269409fb1df4119

    • SSDEEP

      192:BJS7Khum18KHFGOvJ1WTkIW1Pn/d+wqyzMLOVb:BJSmuYm8WTun/d+wqyNVb

    Score
    1/10
    behavioral17behavioral18

    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/Ransomware.dll

    • Size

      20KB

    • MD5

      b5a034e9d15cb09b1460dd18f1257d83

    • SHA1

      956156a47e690c8be8964dc3fb905e075a45e947

    • SHA256

      2bd33a784af634af7590ad9dc43d574005dd95b2b2e20640b97cff0474af91c6

    • SHA512

      026c51e39bb1647f05bd3d5b89357937d848ef5c374240fe8f41bf34eeb70429860d762032a0a954e98a49015d67272be436b14b51fd57e9956cc33aaa07030e

    • SSDEEP

      384:HDKe2SiTtr8SCMNyKU9kbbsXfB+ZMmoI+sHT4k7MWYeLZtHyh:HDehCSCMNzIk3sXP87PYw4

    Score
    1/10
    behavioral19behavioral20

    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/RunM.dll

    • Size

      10KB

    • MD5

      752019b614caf2b24d6d20e12b790ab2

    • SHA1

      6c927f44876b77ffbb5af5ec34fbfdc5e94e6b78

    • SHA256

      ab0fde86be8a9edcad9cf9f91643edcf922e2236abb3176ac581183989fcf99c

    • SHA512

      172901e589cab6f6e0ddd845d9b4ce87d66e4133fe6e52a6827cb92e00c90405c0804c75cefd9acd4b17d70ba1359d80a621425253ccbdb9a4b9112e826b2efc

    • SSDEEP

      192:kb1Q9BJL3C2tCcOEVyOS41NTNIW1Pnb/TPvlzZKA7CgWl:61Q7JCyDIeNTnnb/T3llP7CLl

    Score
    1/10
    behavioral21behavioral22

    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/RunPE.dll

    • Size

      11KB

    • MD5

      5e013ea771fc89907601dfc2af7a6fa2

    • SHA1

      26a340eae644c066805e551a130bf822eef5563a

    • SHA256

      c01ccb79af29e2053e5ab5486d2d0a07c2e4cb15a4df04e25d5f366cf2c94bcd

    • SHA512

      17c37cb6976efadf7b3a92c0d75b34d86461cd2feb3a4d659379e6d8a7c095eb30753b3a31d129ba4bc43be49c31296e56843b54bbedc3dcc4f91b0c5e13785d

    • SSDEEP

      192:glFfqh94qT5rmUrm1eNGOJeq1JQSnIW1fUst+fpo7MLus:glFChWqT5rm57kJQGUst4pods

    Score
    1/10
    behavioral23behavioral24

    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/Script.dll

    • Size

      9KB

    • MD5

      ed33c58ca58f149078212607da7e6d5c

    • SHA1

      82fae75c33144beddb3f587fdf8632cd8fe4c7c7

    • SHA256

      c6a37876cde8772f189f348f1469ad4527c5b9e387c29d653a3cc5283e3b639d

    • SHA512

      52abe4c280126996589eb732a09ba75f4b4f1b8288f46e918e7c2ff8919a33bf9816b4613a453b2bd66cfb4c4dd2adb987ebe8dea2eb6a2d18e9654936a552d0

    • SSDEEP

      192:09a5mkxbPGOWki1iTcIW1Pk/2ZpFRML2G:0qmkxbOIoiTGk/YpFZG

    Score
    1/10
    behavioral25behavioral26

    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/TCPGET.dll

    • Size

      12KB

    • MD5

      8ff53cf98035b5f4cc4fbd149a89e886

    • SHA1

      26dbdae3f67c4d08e5d2ae849e822988c8c9117e

    • SHA256

      8fbd4594f38a12a726d0618e20894e6615985ee96e787edcf2fa90f2f84dd150

    • SHA512

      9d8937a329bf9de09cfb82330aae2dd5ac23392de960d27abac8700696f18169a62ab3307efd53046355ea936808529d548f4e2c185accc8fc78b1663a151ef0

    • SSDEEP

      192:+8nfWHaosO7Pi7tkOfwZO1Z1011HoLIW12z/LDFJIgNQL2w:+ftPi7tpKAKHoUz/fFJIgFw

    Score
    1/10
    behavioral27behavioral28

    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/UACBypass.dll

    • Size

      16KB

    • MD5

      83da32d85a967a145211834033855497

    • SHA1

      39d75d57df6d102c73d0d4e771a0798c3f153d8c

    • SHA256

      ea912ca7c74d76924cdf1e634164d723a6d7a48212ab03c0f343a0132754a41b

    • SHA512

      833a9853255218e1068eb6de8fcec2c985488475771c8209e8c5f8e43fd3ff3fde036b28233fd55f35f4eda2d698f4fe67b6f8410294c1728a9c0350c81f3fd7

    • SSDEEP

      384:N0KGTIkYy8EjM/fVdpaAgiii5TvcayW0:N7yw/9dpaTi5T0aI

    Score
    1/10
    behavioral29behavioral30

    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/Update.dll

    • Size

      11KB

    • MD5

      dd9fcdc7bc3e42d5099a25b6a448761f

    • SHA1

      aa166f56013baf0dcee7ab0d836be44e8c37b706

    • SHA256

      88160d78fc6c9f366475039635713a27b5604c9df54ae05ccb5e6db1801c9138

    • SHA512

      8e1072769a8d7a1eaa0f730c0ad0d931c285ba22c855090e997ce5d018c6d30beafae38d38928eaa0a48b06888246bfc3443810a5eab9a3ee81eb6d234a410a3

    • SSDEEP

      192:HNswkD3S282f6vHR4QJwGOHbHKPBMbOIW1Um0zuWuyV9ip2f/LuT:HNswkDV3f654QDUbsMb/mwuWx9ip2yT

    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Matrix

Tasks