Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

GtagAccGen...ar.exe

windows7-x64

10

GtagAccGen...ar.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    GtagAccGenerator.rar.exe

  • Size

    221KB

  • Sample

    240220-etgkxsag2t

  • MD5

    c16112d579dbae6256c076dc562c46e8

  • SHA1

    2947a83df8d755eff0293248d332b128729ead47

  • SHA256

    6a330a2f685c6526644ba41ccfb45dcc416f1647b49fe7bf45482bc7a133a267

  • SHA512

    2b8978d172d14f0a4a3a2de88f320d2510f8a257b052aec903278c25aef2bdbe23a094a166d16d9c3d99f2d7ddaaccba88ea38317f62740b93ddddeb7471afc4

  • SSDEEP

    6144:gAJm0dobhTx6UhcX7elbKTua9bfF/H9d9n:g2dU63X3u+

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

C2

0.tcp.ngrok.io:8989

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    USB.exe

Targets

    • Target

      GtagAccGenerator.rar.exe

    • Size

      221KB

    • MD5

      c16112d579dbae6256c076dc562c46e8

    • SHA1

      2947a83df8d755eff0293248d332b128729ead47

    • SHA256

      6a330a2f685c6526644ba41ccfb45dcc416f1647b49fe7bf45482bc7a133a267

    • SHA512

      2b8978d172d14f0a4a3a2de88f320d2510f8a257b052aec903278c25aef2bdbe23a094a166d16d9c3d99f2d7ddaaccba88ea38317f62740b93ddddeb7471afc4

    • SSDEEP

      6144:gAJm0dobhTx6UhcX7elbKTua9bfF/H9d9n:g2dU63X3u+

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks