Overview

overview

10

Static

static

1

LSD.zip

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    LSD.zip
  • Size 143KB
  • Sample240402-a5fesacb83
  • SHA256 c56bf7def89f84021fef68e6f982d4353509948cbf64b4ed6e562913e74824d3
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
discordratxwormpersistenceratrootkitstealertrojan

Malware Config

Extracted

Family

  • xworm

Version

  • 5.0

C2

  • 7.tcp.ngrok.io:22206

Mutex

  • gZUzvp6k0Vw7befo

Attributes
  • Install_directory

    %AppData%

  • install_file

    OneDrive.exe

  • telegram

    https://api.telegram.org/bot6356371662:AAF4_y4uR4P5salxGzkxmxDwHJPbGvs4F18

aes.plain

Extracted

Family

  • discordrat

Attributes
  • discord_token

    MTIxNTkxNDE2OTQzNDY0MDQ4NA.GHG2tI.FdChr7ncxdWTRNVDebgqvEe-YEBQ0w9irxSTnI

  • server_id

    1215913648778903614

Targets

    • Target
      LSD.zip
    • Size 143KB
    • SHA256 c56bf7def89f84021fef68e6f982d4353509948cbf64b4ed6e562913e74824d3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discordratxwormpersistenceratrootkitstealertrojan

    • Detect Xworm Payload

    • Discord RAT

      A RAT written in C# using Discord as a C2.

      stealerrootkitratpersistencediscordrat

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks