General

  • Target

    53gggg53.exe

  • Size

    61KB

  • Sample

    240310-ytr67sbd7v

  • MD5

    dfd8940051811715cf56bdb7ddefd04b

  • SHA1

    cc16f41874ff671f600e861ff07b7466cd71a63f

  • SHA256

    60c421160bb15e7135914016b462635bc4001e2b6de7e72f1588cc1259ebb19f

  • SHA512

    aeaef9d69f1a003d832b0ca160331b0f66fab9bf6342e0ff86f95057126c6492c48caea4b7bc7da2bd6ebc103836a487833d61a52d8bc88efe2c8f12f891fcb3

  • SSDEEP

    1536:fim15DW64h50MfeCf6VLGUw5f+bBEk77/fWOGes6:fGD2Cf6Mlf+bBB7/fWOGH6

Malware Config

Extracted

Family

xworm

C2

recently-working.gl.at.ply.gg:56246

Attributes
  • install_file

    USB.exe

Targets

    • Target

      53gggg53.exe

    • Size

      61KB

    • MD5

      dfd8940051811715cf56bdb7ddefd04b

    • SHA1

      cc16f41874ff671f600e861ff07b7466cd71a63f

    • SHA256

      60c421160bb15e7135914016b462635bc4001e2b6de7e72f1588cc1259ebb19f

    • SHA512

      aeaef9d69f1a003d832b0ca160331b0f66fab9bf6342e0ff86f95057126c6492c48caea4b7bc7da2bd6ebc103836a487833d61a52d8bc88efe2c8f12f891fcb3

    • SSDEEP

      1536:fim15DW64h50MfeCf6VLGUw5f+bBEk77/fWOGes6:fGD2Cf6Mlf+bBB7/fWOGH6

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks