Overview

overview

10

Static

static

10

f1752377fd...37.exe

windows7-x64

10

f1752377fd...37.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f1752377fdbc7e2fa65dd744499690174fb3eebc7ffab32598a257b762991937.exe.zip

  • Size

    21KB

  • Sample

    231002-n56hvsac4s

  • MD5

    6a83d7536803873c048411b2bb41e2f1

  • SHA1

    504521516b3480940f6d76096d61faf077020558

  • SHA256

    8b676023c97a3945e7ec83cbe2c8175b7d8f4a49e3f962dd4b2475714c16eef3

  • SHA512

    3bf3326d117458fdd00b4c1244d65593853df565ea93cf63cb2ed217c8dd445494f36d8388752a9daf32418f4d9a0693d44146eee7e24859dd9a11478279706e

  • SSDEEP

    384:3eiZbS68mMZRLlCjarYYiyhIIZa+YmQJSpwpjf/YAn0G94YAxTmJ1w0L1aNdP5C:uiZG6vMZRLlBYhyhYGQoCns41w0wNdBC

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

2.2

C2

pool-roman.at.ply.gg:25972

Mutex

e7QU1ftEFxs2xQLk

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      f1752377fdbc7e2fa65dd744499690174fb3eebc7ffab32598a257b762991937.exe

    • Size

      72KB

    • MD5

      a3f5d53058f221d49248fda07e2a0cf7

    • SHA1

      b5891badc16816f8dd8f5763d13e9f5738470c69

    • SHA256

      f1752377fdbc7e2fa65dd744499690174fb3eebc7ffab32598a257b762991937

    • SHA512

      e1fda1fd90ab269be1079426826009d9a01599f738dc0244f488f73864772bdf098009073b6626342b6c37e26d2e6ec2ff9b98949d5d867a7c07098b91435e08

    • SSDEEP

      768:/osZsQLhSRwMKfNq4uadSBz0RpfGFsQhLOw+ekJot41qU:7qQBWJcfI1OzekJot4wU

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks