General

  • Target

    https://anonfiles.com/hca8Wd22z2/BlitzedV12_rar

  • Sample

    230719-sbjt8ahf2v

Malware Config

Extracted

Family

xworm

C2

special-alpine.at.ply.gg:49821

Mutex

ifFtlTuw6GFgkBgX

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      https://anonfiles.com/hca8Wd22z2/BlitzedV12_rar

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks