Overview

overview

10

Static

static

10

sde.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    sde.exe

  • Size

    63KB

  • Sample

    240224-1p1znafd24

  • MD5

    2759995dc3df341094790f56a02c4239

  • SHA1

    fc0e4dc0c03a46e9e0a3fdd6666b072593de13bc

  • SHA256

    3d0d900263274aebf81508ec8b9dfaa2515f34435f4026711e96bcc8de6d1ccc

  • SHA512

    a2f8d9a3597f1b548f1b5f11950e4b3314d8c3f09981267026eac4943317ccbf024cc63af2599764220d7481840a7096569eb3f0a10efc800d2cf7513eb30e2c

  • SSDEEP

    1536:29uYPxohshGtwJXvkb/ngiZlGPm6rsNOaiL7e:LY5ksycfkb/ntMsNOa0e

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

C2

bad-nebraska.gl.joinmc.link:43858

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Targets

    • Target

      sde.exe

    • Size

      63KB

    • MD5

      2759995dc3df341094790f56a02c4239

    • SHA1

      fc0e4dc0c03a46e9e0a3fdd6666b072593de13bc

    • SHA256

      3d0d900263274aebf81508ec8b9dfaa2515f34435f4026711e96bcc8de6d1ccc

    • SHA512

      a2f8d9a3597f1b548f1b5f11950e4b3314d8c3f09981267026eac4943317ccbf024cc63af2599764220d7481840a7096569eb3f0a10efc800d2cf7513eb30e2c

    • SSDEEP

      1536:29uYPxohshGtwJXvkb/ngiZlGPm6rsNOaiL7e:LY5ksycfkb/ntMsNOa0e

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks