General

  • Target

    XWorm-RAT-main (1).zip

  • Size

    34.8MB

  • Sample

    230412-zdbpysfa34

  • MD5

    82ccb74455818f185b285bcfe0338c7d

  • SHA1

    e30b03aa4e431c7244145963871ab43419440415

  • SHA256

    f0eb7f58edc94075cf2d0567ad4b9c7153f7bdeca5e3537ee88360214f6a9076

  • SHA512

    ed9cd181d17aee8a40c128c8476439f8bd13ce4984881d852eca9f26dcd79e773b637893b4b96194cca866c6483d22ebd3eb762a07f1846dc2aa579b38d3dc6d

  • SSDEEP

    786432:1jVrlNnSWOwfT9SMQ+BpOspoclWQWBtDQXzTnHB35FyGIYyiIKe:hbVSwfhS4TOshANlWh35F/IMI

Score
10/10

Malware Config

Targets

    • Target

      XWorm-RAT-main/XWorm RAT V2.1/NAudio.dll

    • Size

      502KB

    • MD5

      3b87d1363a45ce9368e9baec32c69466

    • SHA1

      70a9f4df01d17060ec17df9528fca7026cc42935

    • SHA256

      81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451

    • SHA512

      1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7

    • SSDEEP

      6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS

    Score
    1/10
    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/7zip.dll

    • Size

      1.3MB

    • MD5

      de03ce2ff4d7f7625352a8c4b44f3196

    • SHA1

      357d3d42fccea225277810d28a43c17ab5dbf3a5

    • SHA256

      201b8405af13e843b30f4cb96961286b11114729a75e9388e2bd717785f95261

    • SHA512

      675d230cd3c28d1b66aa24dc5966cebee426dd85d75775c29e4e61373019456f3d66dab6a2706132d32cd37aed366f00ebe9ce6ae80f31963e02bbf67e0a530e

    • SSDEEP

      24576:u0/LsiV9P+XbiDmHzsvTK6BN2TBQLge+ErnuIAr24sNhHXZ:ucLsk9Pk6gAK6BN2NQUe+ErnuVqjNhHX

    Score
    1/10
    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/ACTWindows.dll

    • Size

      10KB

    • MD5

      b421c1a1915efd31250603caf98a6efa

    • SHA1

      9c54fffa90dc39ed9a63dd405644ca3679c543e8

    • SHA256

      1c921e95d1f35e9aeba1d544362268bd1ac77a1006c215abeb6da9e041b3dee4

    • SHA512

      c6c99379e87fa4108307ce61eaaf1143d4d04c09ca3e8e13cd89b3e3ae3c01e3e641cdf6f9f414001705acb54b3a4bd615bf313764b62fe0f60286b6f8ab27e0

    • SSDEEP

      192:xEioKRFQer7v67Y85ZIwI71tHThIW1PnyWVSBQMLuTF:+ibRFv8DIbtHTrnyWVSQTF

    Score
    1/10
    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/AskUAC.dll

    • Size

      9KB

    • MD5

      4a76da7ba432413e023cc2daef5f73b4

    • SHA1

      c4261cde5160753afba76604e6b71cfc1d95b58d

    • SHA256

      742625b8c8e1ad522dde95931102926aa7f806657879705b4fccaf36614d8d77

    • SHA512

      b43d50ee1385ba9b0e3d712f8e64b7ba4d634fdd9e8927cc330c71d34aae97f66291172cc713176206e0b2bbfeadff34ca5aa0605aa71a00db3434ebaa555bf3

    • SSDEEP

      192:mH563sg1GON8bIsgyBTkIW1Pn/KiVawMLOQ:mpFQ8bWyBTun/KwaAQ

    Score
    1/10
    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/BlankScreen.dll

    • Size

      9KB

    • MD5

      b9d4b5254e5647fdf8236e890d29810a

    • SHA1

      93220a47529f7b0a9181c72481f81f366c211ac7

    • SHA256

      033e790e1cb99781d3d9710553e74de6a3c5e9765eca6c717b23c515708e86a7

    • SHA512

      33be9e0e4bfa8851b1fa389da59b2ed75d8852e8a6cf2b7a410d910578167ce50c917bab2ac264daafa65b0d1f3727a358bea1a01faa71790fab037131c55548

    • SSDEEP

      192:ezfcER2CRuTzi9fTGOlF1LATWEIW1PnaiwpM4QLOBk:ocG2cS+UTWOnaiwpMCG

    Score
    1/10
    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/Chat.dll

    • Size

      18KB

    • MD5

      181599ac647dcaac9bee9be73e40501d

    • SHA1

      fced4627ecc0f8172af1a34e54d226311b54634b

    • SHA256

      29bf5ad7420bf165b555970a15b94b93f9dd288df87a66327022ff9602bccd8e

    • SHA512

      1c835a6749caa39ad9188cda2c6629f2b78adb8388b4010e09e9ad5b326c137c237448006339b6c8ba9d6310bcde06bfb0a3e1ae72f14acca485f9a5bf363e40

    • SSDEEP

      384:qL6SP+OzVEbK6LcuTKQt0InoIInfUUWRfE:M6SP+OBOKmcmqIInfUXm

    Score
    1/10
    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/Chromium.dll

    • Size

      32KB

    • MD5

      34f049112ea43d6cee9ea124282854f5

    • SHA1

      f0ff219107853d5d82f74603f1077d4f4c1c8317

    • SHA256

      ec15606129c31d519b6752d3567b1b2603efe877938443707080c05abaa161e5

    • SHA512

      7b2947529d1f558ba4c54414b58b5f81cfb6fea8181879ec8cdcc2df9c3bff9d1f96a5d79a4191e02dcfb2be132fff39c6dd62283aabe72c3f7254e550e1175a

    • SSDEEP

      768:xGW9spcK+tRAj0xtaqPXvYXP0vzAqaVh6wB3Zs/Yx/3:xGW9jZ2j0xtaqPvYXP4AqQh6Y1

    Score
    1/10
    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/Clipboard.dll

    • Size

      9KB

    • MD5

      9681d56abcdd302dc435e865d4375df2

    • SHA1

      77fa370dbebdd13b18dc6f41f86d2dd64379ee75

    • SHA256

      75b37e44ec0d76cc4862de45f69f362499e7707b3fc0ed03c4b68b04a505ed43

    • SHA512

      1e19afed9b96ae122faa34fdd04a79c9e65270f944992b33aa8a2f894847f01c7fe533c338574367ca8ea5ac0f57c291839e17fa97ecd8d972800b637c5efb54

    • SSDEEP

      192:zPNE2c1og86hRlfOHdv1TLxIW1Pn/+97RML22nU:zFEl1og86RktTLbn/+9NeU

    Score
    1/10
    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/Clipper.dll

    • Size

      10KB

    • MD5

      a91c4c459bfc493552b37cd6ad79eb4e

    • SHA1

      0147792b9c5c21b9a1e68f098803ad7d6876c6fa

    • SHA256

      3087f4c71222172069ffc441a2aca41785562a92260e6fca813a576a8e104fdc

    • SHA512

      6932b326312501c82f0be5ed8fc22d659fbb008ba66087186e814a23b8d31b21f058a4d3226cc6569b713e9e4dc3e8cb535ec1edb395cb5c4548e573252a588e

    • SSDEEP

      192:nfxgo6FiR3r9UdNltsOIO/dQ1GiMIW1Pbe/nPA8/YjNMLOi:nCFar+dN/IEuGiWi/nPA8/8Hi

    Score
    1/10
    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/Cmstp-Bypass.dll

    • Size

      11KB

    • MD5

      b6168619969011ef036cced5e6d2bb88

    • SHA1

      a69ffe4f8f41040ca839772e334d11147965e00e

    • SHA256

      995e755827bf8c1908e64d40a7851e05706b89e41dee63037e5c4be0b61f113e

    • SHA512

      d43890212684841982cb180b246c776b4499f5c3b3d285f87b572a369553023899642cb70faeea2dc1d9f2eec99773d395b6573397d20aae18b685d24cffc7f6

    • SSDEEP

      192:fZCBkF2mSmZbBYBIpN4YeTysxIGOyv4Bb9akegyaTRIW1vr/uTDFs5GATLec7hH0:fYM2mNOBI/UysxZ/QBbUkZyaTjr/6YGY

    Score
    1/10
    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/Computerdefaults.dll

    • Size

      10KB

    • MD5

      20d572d7bb194b9b7401aafba0b81f19

    • SHA1

      adab6e88fd320519ca843630020ea3f4c79071cc

    • SHA256

      6ca31d50033eb1829f126353a849177f74501a4a489148b5beaaee0e564bfe91

    • SHA512

      3b1ed2f277e61484fc1592c62d2059c221d43652b9b5171a6037c85dee11105865832e3532f69fb7ad0f58c5460ede6f2746e62b03013793c00a3a0036a6422a

    • SSDEEP

      192:/y3XzuK0MGO68mgyITjIW1PD/lf5lrljlQ0lIdlUwSxExocTLWlb:/ynzuKcLWyITND/lfeiMo11

    Score
    1/10
    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/DeletePoints.dll

    • Size

      9KB

    • MD5

      bcca9532b7ba99863f929f10087a6d43

    • SHA1

      04a8c8374adb5ef9b316bdf92eba8deaf5e7f947

    • SHA256

      8ea85db9c8e12d3a0240a02d6f0cd9b8b115a0fcb1b24b70d03278c828c31879

    • SHA512

      d59453d83f9c9283c10ecaeadb2e376e86b4ae05f64a91f82b5b4653262db1bb0812ec4a4e1a30c68c8bb6f5ee1a784552936649af0e05cfeab203abd6082f69

    • SSDEEP

      192:nPyV1Piyl52HzGO8X140TwIW12nH8i7eVMLW7:nPyfvWydXTZnHZ7et7

    Score
    3/10
    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/DeleteWD.dll

    • Size

      1.5MB

    • MD5

      d5051b56f7371238d8e7a5361951a6aa

    • SHA1

      a0e45ec01df6bc37c26ffd45562009878de948c3

    • SHA256

      887873a59e10d8000085ad987c802e9fa2d231f31eb2523f4b823f8083f462e0

    • SHA512

      f5879402cf0999cd3e4f9cf156c26cad7d7e73b7be84d311ffb0abaa065cf822e19c2f3c4a89a24588bd96c59e625201ac19f7d3702cd76089e87a27a7a4a6f6

    • SSDEEP

      24576:8BW+1C0G0faR5wNRXLbLKavHBNmWC7vOIMmxXTffuu3TG+R+aNAdpCmlY/64IxLJ:8Bx1HQ0VXLpNyzM+XD2uDz+amLC0jHxL

    Score
    1/10
    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/DicordTokens.dll

    • Size

      6KB

    • MD5

      7ad4756cde3dd26bdbe03cc583527a06

    • SHA1

      557e9a05dd00764c13c1c2ab93d3520f86a93dd1

    • SHA256

      493ce4fdfceacc0ffdae460dafcc352a3792de437b6a7587c7731a5c900409b8

    • SHA512

      80d934b4befc75dffd1abe27945152cffd8a7f9be035ef5d534b2d5bee2f630a436a7841fd1c5ecc02876242d520cac5825c9016e6bcb7e12613baa29db1ad1f

    • SSDEEP

      48:6OIT/BvVV5VydE/tjIaVvNXOu5RKgS8PCtcUl8nNMAcx3numn2sex05x0oT+Hml3:OBpVydE/9Fiwvx6tcUlrA0v0s+mltIJ

    Score
    1/10
    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/DisableWD.dll

    • Size

      13KB

    • MD5

      7af0f08b780ae3a26118f167a2c2f8b0

    • SHA1

      c473cf621bac31c1af4e59903012fb027dc75105

    • SHA256

      d384ec908583b271588a27748850e4cadf9d8b55a4afdfa54170738da54fc4ef

    • SHA512

      231c59aed5967fb42685b1cd867ade5cf6944c145de290eefc969d57f574cccae09451af3e42416b0c9126bac7e07bb57cbab74be269a9e99619411f79704bb3

    • SSDEEP

      192:iQLEv8T4LLpNkQvmDbeNEDTRQmCkUE2WKU1GO0zb7lgJ1T9IW1Un/3eKtfLie9y1:iojqEdJUEDtw9zbyJ1TMn/3euG4XFU

    Score
    1/10
    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/Email.dll

    • Size

      4.8MB

    • MD5

      cbc0e4c9693b2769634ba4400249a4b3

    • SHA1

      a889e9a53ab94ec507ff1a2a7e6fc3258647f82b

    • SHA256

      08c0561606c50327e52d20d67e447431beffff4357c011d5df58c7923cea82c0

    • SHA512

      9f0d39423c3b5076fdfd39f52282d6fb1cb044984a8de936108d114e139a657718209a878ba95d52f021c6bd554cd71a17f408c9c02de70dfa6f07d06ea78a8c

    • SSDEEP

      98304:K1RA+vAQO328PXuSYibjYKcQo4wTej9r++rf2nydtrQ:kRA+C32/anYj2nOSm

    Score
    1/10
    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/Encoder.dll

    • Size

      11KB

    • MD5

      273d8c94b9b7cd9526d44289115e72c3

    • SHA1

      b8e1911a0ca4f1439838f89e136e27dafe41c97e

    • SHA256

      dc51fb8a0140ba8cfcb19dab7f29cfbcd0579a08c3c1d68b915d2b59a8a93a71

    • SHA512

      d3f3bd8e46baa152bdfdb5633136134d94920616fb00463a2437e162a50e7ea9d3f9f1c3e15fa1c814d10ae2d71275d8615ae1b4d268e15f7ecd4e89a3fe507a

    • SSDEEP

      192:Jj9Y4KofL4k6PplZEdld5efBGOzutx1b+T+IW1PnQ7SiSpjzH/L2wRc0:Jj9woj4RUrPefMCuVqTAnQSpjz6wv

    Score
    1/10
    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/FileSeacher.dll

    • Size

      474KB

    • MD5

      5e500219492ffe9927eb36600e58fc10

    • SHA1

      75d54f8e39c5c12fdfed92d9872283929a603368

    • SHA256

      86bf7cfe573f4c36645cc30bcbc5a9aab7b9925f3a1f2cdcfb4b86829b09637a

    • SHA512

      b593a6ba337f0d21cd8caf7d15fa14731a7dd2108560a2cdc700e2c2c8435d46781c7adf7d27da827d1bd5a0bb584a724d937d0e456dbe420d959cb783631c05

    • SSDEEP

      6144:8+Zza7lMB+meGtSV41QJDsTDDh0Yhe6dwxLV/tuhg3MwBIl0T:8+Zza7lMB+mlS4Ys50ie6Cf4g3Zw0

    Score
    1/10
    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/FileZilla.dll

    • Size

      6KB

    • MD5

      926db64536c6996e5c377d89caacdde8

    • SHA1

      f3233095e3a7dfe1ae7cf59a1bb10b3606ded6fb

    • SHA256

      da994e868ad929e7d90b413737789aedac7b5345ecede1c79be54715cd0c1ce5

    • SHA512

      424b485add47844fa5fe6afc8cb9aae6f4038e374b1b334fb71fc5df4f47f363896ef88487a3405870e8f8e858651ce004368e867a41e2ffc1c282acfe928e3d

    • SSDEEP

      96:MUW9xv14nJtKZhYSvvwZDo4i0udeW3AXTA:A9Z1+vKZhzvv0Do46T3AXU

    Score
    1/10
    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/HRDP.dll

    • Size

      479KB

    • MD5

      e3ce88d6f031a66fa267f53ce60d14fb

    • SHA1

      52b937fcb2b78e677252b146c7c50e4230fa9153

    • SHA256

      6549c2a9be50aed342cd29b4a48d2fd9c15bffd16eec7fb94a49e10472bf03a3

    • SHA512

      f20b978ca244d91d818b11e934334183b77eaf46ba6ce48fe3fd3a4e6ba189f466fc125c41bad556ac2c0d8e647f406cb403577198e8556d874164b15c352631

    • SSDEEP

      12288:3KBbEVy2humYgLmm3HiYRbli1FaWFXlzeAWx:aB2yqjmm3Hi8c7aI0

    Score
    1/10
    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Plugins/uninstall.dll

    • Size

      11KB

    • MD5

      b940dbf98a4b1c79e7b56f015fc8b856

    • SHA1

      6f526b0bd8f1f84745089980cd3472e2fbe4fdc2

    • SHA256

      420c4a9616a17dcf49c790b01c00e65c2510cd052b255d9a85da955b1c8a8e7c

    • SHA512

      6f5fc00a4d13ded7c6543aad7481a6dd2f026d16fb648e7d454d3a9f884a5a6296e188119773d399ac8440b07816c273a7840c4e925990e4d24d34a57bcced92

    • SSDEEP

      192:c+qBfv8vZvrSpshmeb7hSoeS/nmGODbHoPBfbjIW1Um0zHB0VAXp7y/LWZEk:czBfv8vZvr5Dld7gbifbOmwHoip7hZEk

    Score
    1/10
    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Tools/HVNC-Server.exe

    • Size

      112KB

    • MD5

      2bc558b0cf60f8c5a17d16299e07a030

    • SHA1

      9a6a53a088cdbab38201b11015e58aacb85e1dc6

    • SHA256

      83178407d4761df1439304df2f08ec6df4e216986fab12590b6339186291b591

    • SHA512

      21ed30fb07a670ca4cf44527d34d201735dac1a9c23e7cc709983c3dbff75cdeec8380c2fe795270fd77203fa9e59b34a324acdb0815c8654b819269e52d9ce8

    • SSDEEP

      3072:cl/0Gw9hSR3UFqhHe9Z0SZDz4PUF8FaBh3:cl8GjtChHh3

    Score
    1/10
    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Tools/ResHacker.exe

    • Size

      1.0MB

    • MD5

      d285a10c73da68b027951a2038a7ae0d

    • SHA1

      e3e5712df92ed49d6cd429799e6e557af093da06

    • SHA256

      aeeac91ca85c59309a8d6f7109a84e1ee6d4817498417373e7c3c93dac7bb1e5

    • SHA512

      150b47f6b4ab2c33c818843ddf30562c85055c1be5bbda7bc347bf36116b4d8d8f7b78303342e9eb667facd37a841eb7d930de325f25d170b680e97f8dfed48e

    • SSDEEP

      24576:XS9wlTzi2gQO1PMV2DCHAJ2glv9fJVOYfJSzaSArbz2jQOS/:C9ijgQO1PMDozYAPz2UN/

    Score
    1/10
    • Target

      XWorm-RAT-main/XWorm RAT V2.1/Tools/vncviewer.exe

    • Size

      1.5MB

    • MD5

      b8d15cd10f1e9ff6adeae64fbbeb755b

    • SHA1

      f962549e42b58a056b11a9ba9750a30bc76844d7

    • SHA256

      823168f7ff268a96aa80d915d946411ef214e7597c73312b19f9723d704b1396

    • SHA512

      1478c76b08a8aa9cf9db927ea371c192ade81d8e27d394613f05aa60011fa8bc46ada115ab4c8c9aa75fcf86dbb62f7089a211f58270c984a204c91465cd07af

    • SSDEEP

      24576:Jj/05kjHhc0Vo68/RWyVae30Zh6FSCTpf2kveQn5poM5lcOBo:JY5kdc0G68/RVoe3+MTZ2kFroM5lxBo

    Score
    1/10
    • Target

      XWorm-RAT-main/XWorm RAT V2.1/XHVNC.exe

    • Size

      1.9MB

    • MD5

      4904329d091687c9deb08d9bd7282e77

    • SHA1

      bcf7fcebb52cad605cb4de65bdd077e600475cc7

    • SHA256

      e92707537fe99713752f3d3f479fa68a0c8dd80439c13a2bb4ebb36a952b63fd

    • SHA512

      b7ba131e9959f2f76aa3008711db9e6f2c4753a232140368be5c8388ab0e25154a31e579ef87fe01a3e4bc83402170bb9fbf242c6f01528455246b793e03fdfb

    • SSDEEP

      24576:CmErCsazef+APWb6+CILRbTcJiWevOIWr9Lrdl5p0WdaMCtGjC+Ub:CPF+CWb6+CILRncZe65rb5p0ehVCr

    Score
    7/10
    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    • Target

      XWorm-RAT-main/XWorm RAT V2.1/XWorm-RAT-V2.1-builder.exe

    • Size

      3.2MB

    • MD5

      339b7f92641c0f5161731fc681aaeb3a

    • SHA1

      21d2d89e9ade90df638f33d314ac68e30f6aa52e

    • SHA256

      b6fb77dfd00695678b06ed122523a0b067077fe69113f395661cd3be748d9f7c

    • SHA512

      58e5ff1d92be52df114b7f060d700823dff9158ec765cf9b19ab9df0ace2669405467f49d1bd56ce04871683fbcbaace5976ebdbd1575490ff411333a3905134

    • SSDEEP

      24576:o08GeFzFDzPLDP8c1uAowyLQfB/eVjKIOQaBcM707ae8gpeJF+kR8YD2Y35/5Mb6:4/TjrHWKWDOQko29ueJsq8z

    Score
    3/10
    • Target

      XWorm-RAT-main/XWorm RAT V2.1/dnlib.dll

    • Size

      1.1MB

    • MD5

      9ed69fbbfdec5d95ea229da3969dd77b

    • SHA1

      7972339f0a1b6a28a2f335c84cdfc5d9beee72b6

    • SHA256

      e8bc7a627149386cb3cf714ae0101f69440f72cf2e7468a677b727b32aaed755

    • SHA512

      61bfaa00736487ed736a27c1a9e45ce14b578452471866d195ce1a4736e72bd4bec98938b8cbb83ffbf09cbf188e9b8760452cc95ee30565414882aadd0171a6

    • SSDEEP

      24576:+9itfCdSZYeP0jsLpPl44znxuhv7fBTu1Z:W5QF6

    Score
    1/10

MITRE ATT&CK Matrix

Tasks