General

  • Target

    XWORM 5.2.zip

  • Size

    31.4MB

  • MD5

    95894f51fe17b6d6428df86934edab2a

  • SHA1

    876ab78440bb2254a586171edc6c9908796b6d88

  • SHA256

    2d0a06addb8df742c7f305b91b32ae0d9efdaa83ac3434765d2bf01d39a12d5a

  • SHA512

    06c4d769cde5a3fa147d956013e543aa70e3d8d561df9f95b7f792c4e11d81b5ccebbe17271176ec9d85980485771e0ac2f98631eff26c26668d2a556de56753

  • SSDEEP

    393216:UUvVaTS2BCJcBk3TeGFRDiiC+x1LJBBekbuVe90KqLYxrdzaSaZl3OGqawfVNbMI:J9XZaGznC8EVe9eLYz65OHvzbMzE

Score
10/10

Malware Config

Signatures

  • AgentTesla payload 1 IoCs
  • Agenttesla family
  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • StormKitty payload 1 IoCs
  • Stormkitty family
  • Unsigned PE 55 IoCs

    Checks for missing Authenticode signature.

Files

  • XWORM 5.2.zip
    .zip

    Password: 1

  • Background.png
    .png

    Password: 1

  • FastColoredTextBox.dll
    .dll windows:4 windows x86 arch:x86

    Password: 1

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Fixer.bat
  • GMap.NET.Core.dll
    .dll windows:4 windows x86 arch:x86

    Password: 1

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • GMap.NET.WindowsForms.dll
    .dll windows:4 windows x86 arch:x86

    Password: 1

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • GeoIP.dat
  • Guna.UI2.dll
    .dll windows:4 windows x86 arch:x86

    Password: 1

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • IconExtractor.dll
    .dll windows:4 windows x86 arch:x86

    Password: 1

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Icons/icon (1).ico
  • Icons/icon (10).ico
  • Icons/icon (11).ico
  • Icons/icon (12).ico
  • Icons/icon (13).ico
  • Icons/icon (14).ico
  • Icons/icon (15).ico
  • Icons/icon (16).ico
  • Icons/icon (17).ico
  • Icons/icon (2).ico
  • Icons/icon (3).ico
  • Icons/icon (4).ico
  • Icons/icon (5).ico
  • Icons/icon (6).ico
  • Icons/icon (7).ico
  • Icons/icon (8).ico
  • Icons/icon (9).ico
  • Mono.Cecil.Mdb.dll
    .dll windows:4 windows x86 arch:x86

    Password: 1

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Mono.Cecil.Pdb.dll
    .dll windows:4 windows x86 arch:x86

    Password: 1

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Mono.Cecil.Rocks.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Mono.Cecil.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • MonoMod.Backports.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • MonoMod.Core.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • MonoMod.ILHelpers.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • MonoMod.Iced.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • MonoMod.Utils.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • NAudio.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Plugins/ActiveWindows.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/All-In-One.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Chat.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Clipboard.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Cmstp-Bypass.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/FileManager.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/FileSeacher.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/HBrowser.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/HRDP.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/HVNC.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/HVNCMemory.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/HiddenApps.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Informations.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Keylogger.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Maps.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/MessageBox.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Microphone.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Ngrok-Disk.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Options.dll
    .dll .ps1 windows:4 windows x86 arch:x86 polyglot

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Pastime.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Performance.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/ProcessManager.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Programs.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Ransomware.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Recovery.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Regedit.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/RemoteDesktop.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/ReverseProxy.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/RunPE.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/ServiceManager.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Shell.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/StartupManager.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Stealer.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/TCPConnections.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/UACBypass.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/VB.NET Compiler.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/WSound.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/WebCam.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • RVGLib.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Readme.txt
  • SimpleObfuscator.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Sounds/Chat.wav
  • Sounds/Intro.wav
  • XWorm V5.2.exe
    .exe windows:4 windows x86 arch:x86

    a9c887a4f18a3fede2cc29ceea138ed3


    Headers

    Imports

    Sections

  • XWorm V5.2.exe.config
    .xml
  • XWormLoader 5.2 x64.exe
    .exe windows:4 windows x86 arch:x86

    a9c887a4f18a3fede2cc29ceea138ed3


    Headers

    Imports

    Sections

  • XWormLoader 5.2 x64.exe.config