General

  • Target

    2649ef15cf6004b05c80abd825cd594e.bin

  • Size

    42KB

  • Sample

    240328-bhny3scd5z

  • MD5

    55c2ad4ab1b62937b8978fac99a6e66b

  • SHA1

    538970df6155b84e535036669f2b1e4c386f8947

  • SHA256

    cc7cf0c410697552614fd56ffc8f26b3048f4f4e8ba5ff84c302f0959e7f0859

  • SHA512

    373740088c3c0f4f5e290f7bf7de5d87a800682792c9081cce9556511ae84c31fc27a8513c120dd8974fb46d0592d7eff259f1e8d9b0718c8a1a7d177b7b8bb5

  • SSDEEP

    768:0i8ml4xBg5oHFpDIWlFNKMP2QLqaYeNf8LS/mig6qxSTZQWiF7:gkMhHFpD7FIMPQ8UL+dPqCZQ7

Score
10/10

Malware Config

Extracted

Family

xworm

Version

3.0

C2

157.254.223.19:8081

Mutex

i0Yq2Adr82znjD2G

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    USB.exe

  • telegram

    https://api.telegram.org/bot5498061286:AAEOFPFhizSA_AbkzDV_OWcHlXVsegPpL_c/sendMessage?chat_id=1267602057

aes.plain

Targets

    • Target

      e6f7963c726231571294a06e1e8b1f03b87684cad8383bb194b957fc685685c2.exe

    • Size

      148KB

    • MD5

      2649ef15cf6004b05c80abd825cd594e

    • SHA1

      2593cb7db276d90d51ea5235eb4c14cbd8ecd5a5

    • SHA256

      e6f7963c726231571294a06e1e8b1f03b87684cad8383bb194b957fc685685c2

    • SHA512

      3b1367d52cb5f99bce35fee1d6414de92a9f10e8df6dfd27c6872e5c4783eba9bd0ed5a6d645fd93b81a064f46a00e25fa6d8404e2881f3006f8b04f2ad67ddc

    • SSDEEP

      1536:RQuj357A7FK9fYP063O+xrBOybBYfOS4J+1oEhyiHn:quj5wFK9fYPJO+XtYmS4g+Ehfn

    Score
    10/10
    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

MITRE ATT&CK Enterprise v15

Tasks