Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

bMvg.exe

windows7-x64

10

bMvg.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bMvg.exe

  • Size

    41KB

  • Sample

    230508-shxdwsbc38

  • MD5

    dc455e0fc8fb490a442f90d6809c4acf

  • SHA1

    81a5f561e27f4b47d8f9cb75f652590d0b3084f9

  • SHA256

    3f81d7b9fd754f15331a5ef322931b07154673d74160c3008b0af32909da996a

  • SHA512

    e5bb9b5a56ec774c90fecd05953b093f872a0243082e656ef083a9982381c0973a0db66f3fced6cb38cc69b27b1de355f7f8a27112e1388d167641f9f2e7305e

  • SSDEEP

    768:R8ROoJD+YzyzvL0TFe4qjmx7UlOUIIG0h/uRDsQhLODDoR/+t6+:R8ROEDbzyv0BeDjWAIUxNuRv1O3k/+f

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Mutex

DzففZ2wp4RHcلي2I

Attributes
  • install_file

    USB.exe

  • pastebin_url

    https://pastebin.com/raw/yppjG8bz

aes.plain

Targets

    • Target

      bMvg.exe

    • Size

      41KB

    • MD5

      dc455e0fc8fb490a442f90d6809c4acf

    • SHA1

      81a5f561e27f4b47d8f9cb75f652590d0b3084f9

    • SHA256

      3f81d7b9fd754f15331a5ef322931b07154673d74160c3008b0af32909da996a

    • SHA512

      e5bb9b5a56ec774c90fecd05953b093f872a0243082e656ef083a9982381c0973a0db66f3fced6cb38cc69b27b1de355f7f8a27112e1388d167641f9f2e7305e

    • SSDEEP

      768:R8ROoJD+YzyzvL0TFe4qjmx7UlOUIIG0h/uRDsQhLODDoR/+t6+:R8ROEDbzyv0BeDjWAIUxNuRv1O3k/+f

    Score
    10/10
    xwormrattrojan

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks