Overview

overview

10

Static

static

3

aaa.png.exe

windows7-x64

1

aaa.png.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    aaa.png.exe

  • Size

    800KB

  • Sample

    240219-pgh84ada8t

  • MD5

    d15ad1c6bd5e317533b04ef9eeb4dba6

  • SHA1

    57a422b2554e1e3e3d49baa675753b603150a38d

  • SHA256

    cb0eec053974139f82268710c939fe6979a80e2ce7cec71fa43be8528c317271

  • SHA512

    d0d210c7ca424cbb38cd227bc987f29a65b0a2eb894e3b20b475cd10b5f16284a1da981f0f4898d14b3362eb9a41c1e4ab648c4cd999d718411f4fa73d926543

  • SSDEEP

    12288:n4nD4q7+6D4utDCjOoK0X0Z07dYJLKKPq0HrtC+IFcf/HV1v6xKSG6EvTda:+D4q7N2OyX0adYQJHe969G3

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:7000

192.168.153.129:7000

192.168.247.1:7000
Attributes
  • Install_directory

    %Temp%

Targets

    • Target

      aaa.png.exe

    • Size

      800KB

    • MD5

      d15ad1c6bd5e317533b04ef9eeb4dba6

    • SHA1

      57a422b2554e1e3e3d49baa675753b603150a38d

    • SHA256

      cb0eec053974139f82268710c939fe6979a80e2ce7cec71fa43be8528c317271

    • SHA512

      d0d210c7ca424cbb38cd227bc987f29a65b0a2eb894e3b20b475cd10b5f16284a1da981f0f4898d14b3362eb9a41c1e4ab648c4cd999d718411f4fa73d926543

    • SSDEEP

      12288:n4nD4q7+6D4utDCjOoK0X0Z07dYJLKKPq0HrtC+IFcf/HV1v6xKSG6EvTda:+D4q7N2OyX0adYQJHe969G3

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks