Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    tmp

  • Size

    95KB

  • Sample

    231126-jm9eksff4x

  • MD5

    c83359f746eb240727873f83f3881db0

  • SHA1

    d2bf8a67d2a29e8a48ad685e3e586fde9a7e48a6

  • SHA256

    ee7dd18f59e73fc4569a7a2564d52d6ee55b19757f89f57b17e35f32eb88327b

  • SHA512

    00c30f2c9e38b7b09be0e7729d70803c7ab7d3b9e6b29592119050319b176ba0ca6b79c513c3afce1de025a968c5e278468eda9ccdbe2a9415635a68e715b05a

  • SSDEEP

    1536:n1C8TP7w1ZJFfw9VGzlxjrR751lNz0UCdkV/L7e:1CaP7wHnfw9QxlN5T6

Malware Config

Extracted

Family

xworm

C2

needforrat.hopto.org:7000

Mutex

4DmqnprMzJEWl3vs

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      tmp

    • Size

      95KB

    • MD5

      c83359f746eb240727873f83f3881db0

    • SHA1

      d2bf8a67d2a29e8a48ad685e3e586fde9a7e48a6

    • SHA256

      ee7dd18f59e73fc4569a7a2564d52d6ee55b19757f89f57b17e35f32eb88327b

    • SHA512

      00c30f2c9e38b7b09be0e7729d70803c7ab7d3b9e6b29592119050319b176ba0ca6b79c513c3afce1de025a968c5e278468eda9ccdbe2a9415635a68e715b05a

    • SSDEEP

      1536:n1C8TP7w1ZJFfw9VGzlxjrR751lNz0UCdkV/L7e:1CaP7wHnfw9QxlN5T6

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks