Overview

overview

10

Static

static

10

d9c88ab29f...62.exe

windows7-x64

10

d9c88ab29f...62.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    38dac2d34f499f649daf32e91097da5a.bin

  • Size

    36KB

  • Sample

    231008-brbecahc4x

  • MD5

    31c875abd29dc23b0a23be20e517ed00

  • SHA1

    509ea3b77298a56e9d56956b20c9daf8d6558f2c

  • SHA256

    72b08e2b710983945b13b608dc9b899fb7c90bf391be5c960f69ab8499a57ab1

  • SHA512

    0f3632e25ae2f9842eed104aeaf0879ac97e68fbac949d383ef5aec171a8e55b2095dbe4c70b563eaac876dc66153eb9f3266f4353d41981b04a8c4de15749d8

  • SSDEEP

    768:/1Xmf3zBigAbuL2aFyx8e4qxWbDaFt8lFZS2ZyewgXZLDJekhqAW:9cjIgAGJQ8eKbWQLiewYJThdW

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

3.1

C2

0.tcp.ap.ngrok.io:18448

Attributes
  • install_file

    USB.exe

Targets

    • Target

      d9c88ab29f40ca6865aa0b0a99e8fe0ad9e00d57c88e084e94d70bf2ecf53b62.exe

    • Size

      59KB

    • MD5

      38dac2d34f499f649daf32e91097da5a

    • SHA1

      9c00c3b2163fa27b68f62366e02c68aec60f2ea5

    • SHA256

      d9c88ab29f40ca6865aa0b0a99e8fe0ad9e00d57c88e084e94d70bf2ecf53b62

    • SHA512

      ed7db87e55c68fa768a31005788804b00d7433ac6e1e4bd0dd36991695546659a60bc94a6fc87d8a13dd425d6bb3e52e4e24104bd773b674d2e2c05814d292ac

    • SSDEEP

      768:1ziB2eYBrG86acGQ3Ely+6wPYZ/tbh6d2bjrd3XDZbP0itDuevOkshBuodbfgTz:1ziE7iPguzrljblDZbP0itPvOpJI/

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks