General

  • Target

    Client.jpg

  • Size

    58KB

  • Sample

    230718-vdcj2acd53

  • MD5

    c16d714f359d4659a1f5fef8be99fd30

  • SHA1

    791f114b0eca05e9792e3248e3d1bf12faa22d28

  • SHA256

    33d49b9ad752f7b92649e62770841545de758850bbeb1ccfc746855f2cebe594

  • SHA512

    38d5b7a37836782fc0dbf170273572ffad76827c40c2ca8e73dddd23cfb2642947409200a2dc2e72d19867a5a41c7ab1ce724de1cd40f3be9bb509180a7191bc

  • SSDEEP

    768:G+UqXqUDmxqoF2vLSFoRd0Rp0wo3sQhLOqwoE/6DuVWTDqEJPxVchVWTDgV1VaXN:btqFqZWDnc1OkE/6DUUjPxVcjUEP0N

Score
10/10

Malware Config

Extracted

Family

xworm

C2

168.119.98.142:4100

Mutex

lZosFAAAHlhl0uFX

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      Client.jpg

    • Size

      58KB

    • MD5

      c16d714f359d4659a1f5fef8be99fd30

    • SHA1

      791f114b0eca05e9792e3248e3d1bf12faa22d28

    • SHA256

      33d49b9ad752f7b92649e62770841545de758850bbeb1ccfc746855f2cebe594

    • SHA512

      38d5b7a37836782fc0dbf170273572ffad76827c40c2ca8e73dddd23cfb2642947409200a2dc2e72d19867a5a41c7ab1ce724de1cd40f3be9bb509180a7191bc

    • SSDEEP

      768:G+UqXqUDmxqoF2vLSFoRd0Rp0wo3sQhLOqwoE/6DuVWTDqEJPxVchVWTDgV1VaXN:btqFqZWDnc1OkE/6DUUjPxVcjUEP0N

    Score
    10/10
    • Xworm

      Xworm is a remote access trojan written in C#.

    • Drops startup file

MITRE ATT&CK Matrix

Tasks