Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

XWormLoader.exe

windows10-2004-x64

10

Resubmissions

08/10/2023, 02:15

231008-cpn34abg92 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XWormLoader.exe

  • Size

    114KB

  • Sample

    231008-cpn34abg92

  • MD5

    445416feb4af892c3eec6ded8f096640

  • SHA1

    55b1e3ded6047f356f768897b4311f4a0c2d5fc5

  • SHA256

    a3117471e5def03a3e40743111d5f2382a04331356e256b02a4a07ecd3575a12

  • SHA512

    b8aacc765c46711df5b9d42fd314fff1146f8f5e24628ffdda9a23e309dd925ea848862b2dd05220f7cf3763166846d8c469316a0502a11da01018228858ce4b

  • SSDEEP

    1536:gVzoQD1KmzGkzf2as/bBcGjLzy6p69nL5yCOmZhiybUojgTmbIr7D6DULNtt7mw:2fD88aas/bBNfYUCOmDtbzar7EEd7x

Score
10/10
xwormpersistencerattrojan

Malware Config

Targets

    • Target

      XWormLoader.exe

    • Size

      114KB

    • MD5

      445416feb4af892c3eec6ded8f096640

    • SHA1

      55b1e3ded6047f356f768897b4311f4a0c2d5fc5

    • SHA256

      a3117471e5def03a3e40743111d5f2382a04331356e256b02a4a07ecd3575a12

    • SHA512

      b8aacc765c46711df5b9d42fd314fff1146f8f5e24628ffdda9a23e309dd925ea848862b2dd05220f7cf3763166846d8c469316a0502a11da01018228858ce4b

    • SSDEEP

      1536:gVzoQD1KmzGkzf2as/bBcGjLzy6p69nL5yCOmZhiybUojgTmbIr7D6DULNtt7mw:2fD88aas/bBNfYUCOmDtbzar7EEd7x

    Score
    10/10
    xwormpersistencerattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Modifies Installed Components in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks