Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

NEAS.bKQSexe_JC.exe

windows7-x64

10

NEAS.bKQSexe_JC.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEAS.bKQSexe_JC.exe

  • Size

    55KB

  • Sample

    231006-zm9y4sab33

  • MD5

    b51dbe03a7d7ed5046b6c75593ec2090

  • SHA1

    f5279fab9888b810cbdebebb8eab8d8025228023

  • SHA256

    50cc18e65b1e6ca61f84eb2e255af53d1088db17585675c7eccc7a2236c13606

  • SHA512

    b892fb1925e3e7a362bb55f0750a50a2a1aad8aad1bc8ed2055d9dd8c7cc1157a843c12a5a72e4deeab5dcd15097d85235a5c106f7197001903dd66f206d3c26

  • SSDEEP

    1536:MmwablEM7GSILzczbVFos9ptzOMlz7bB42:MRJpzczbVr9Oiz7y2

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

3.1

C2

serverwindor.duckdns.org:5000

Attributes
  • install_file

    USB.exe

Targets

    • Target

      NEAS.bKQSexe_JC.exe

    • Size

      55KB

    • MD5

      b51dbe03a7d7ed5046b6c75593ec2090

    • SHA1

      f5279fab9888b810cbdebebb8eab8d8025228023

    • SHA256

      50cc18e65b1e6ca61f84eb2e255af53d1088db17585675c7eccc7a2236c13606

    • SHA512

      b892fb1925e3e7a362bb55f0750a50a2a1aad8aad1bc8ed2055d9dd8c7cc1157a843c12a5a72e4deeab5dcd15097d85235a5c106f7197001903dd66f206d3c26

    • SSDEEP

      1536:MmwablEM7GSILzczbVFos9ptzOMlz7bB42:MRJpzczbVr9Oiz7y2

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks