Overview

overview

10

Static

static

10

XWorm-V5.0...db.dll

windows7-x64

1

XWorm-V5.0...db.dll

windows10-2004-x64

1

XWorm-V5.0...db.dll

windows7-x64

1

XWorm-V5.0...db.dll

windows10-2004-x64

1

XWorm-V5.0...ks.dll

windows7-x64

1

XWorm-V5.0...ks.dll

windows10-2004-x64

1

XWorm-V5.0...il.dll

windows7-x64

1

XWorm-V5.0...il.dll

windows10-2004-x64

1

XWorm-V5.0...ts.dll

windows7-x64

1

XWorm-V5.0...ts.dll

windows10-2004-x64

1

XWorm-V5.0...re.dll

windows7-x64

1

XWorm-V5.0...re.dll

windows10-2004-x64

1

XWorm-V5.0...rs.dll

windows7-x64

1

XWorm-V5.0...rs.dll

windows10-2004-x64

1

XWorm-V5.0...ed.dll

windows7-x64

1

XWorm-V5.0...ed.dll

windows10-2004-x64

1

XWorm-V5.0...ls.dll

windows7-x64

1

XWorm-V5.0...ls.dll

windows10-2004-x64

1

XWorm-V5.0/NAudio.dll

windows7-x64

1

XWorm-V5.0/NAudio.dll

windows10-2004-x64

1

XWorm-V5.0...ws.dll

windows7-x64

1

XWorm-V5.0...ws.dll

windows10-2004-x64

1

XWorm-V5.0...ne.dll

windows7-x64

1

XWorm-V5.0...ne.dll

windows10-2004-x64

1

XWorm-V5.0...at.dll

windows7-x64

1

XWorm-V5.0...at.dll

windows10-2004-x64

1

XWorm-V5.0...rd.dll

windows7-x64

1

XWorm-V5.0...rd.dll

windows10-2004-x64

1

XWorm-V5.0...er.dll

windows7-x64

1

XWorm-V5.0...er.dll

windows10-2004-x64

1

XWorm-V5.0...er.dll

windows7-x64

1

XWorm-V5.0...er.dll

windows10-2004-x64

1

Resubmissions

08-04-2024 14:10

240408-rg3c3sba45 10

08-04-2024 14:07

240408-re6bysah74 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XWorm-V5.0.rar

  • Size

    28.8MB

  • Sample

    240408-re6bysah74

  • MD5

    f778fc725ed79c15d3ad889e7a33bea8

  • SHA1

    6dfce5a46e080fb2436b09a5ed68b98b4c28c17d

  • SHA256

    c2a1b97d657542e949496bc96e5a6c4e0beb101a629e7591519d0cb7e906dbfa

  • SHA512

    ecb5365ae67963d1d246851a852fda53d7ed100e99377d340124b432a3d502044d4ae3abf2e67f7b1224dd08e42e45906d173fcf0e667ec1f052102a4196745a

  • SSDEEP

    786432:6yo/MS7REHxn8OlhE5INyrYl4M9fumjXmwowxMza:E9iWyhE5+yreZ9tXmw/xMza

Score
10/10
agentteslaxwormagilenet

Malware Config

Extracted

Family

xworm

Version

5.0

C2

testarosa.duckdns.org:7110

Mutex

Rg1w8TcZ1AXGhMnB

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    WindowsDefender.exe

aes.plain

Targets

    • Target

      XWorm-V5.0/Mono.Cecil.Mdb.dll

    • Size

      42KB

    • MD5

      1c6aca0f1b1fa1661fc1e43c79334f7c

    • SHA1

      ec0f591a6d12e1ea7dc8714ec7e5ad7a04ef455d

    • SHA256

      411f8ed8c49738fa38a56ed8f991d556227d13602e83186e66ae1c4f821c940b

    • SHA512

      1c59e939d108f15881d29fe4ced4e5fa4a4476394b58b6eb464da77192cb8fe9221b7cd780af4596914d4cce7c3fc53f1bb567f944c58829de8efbe1fd87be76

    • SSDEEP

      768:Ar5EYZep98C87KHeBUZwrEzsEAnbF+em50KktmM4CRIcZwMRTIzMAtpw:Ar59g98C87KHeBUb5AnZG+zdwMRTzAtS

    Score
    1/10
    behavioral1behavioral2

    • Target

      XWorm-V5.0/Mono.Cecil.Pdb.dll

    • Size

      87KB

    • MD5

      6d5eb860c2be5dbeb470e7d3f3e7dda4

    • SHA1

      80c76660b87c52127b1a7da48e27700f75362041

    • SHA256

      447ede1984bb4acd73bd97c0ec57a11c079cee8301c91fb199ca98c1906d3cc4

    • SHA512

      64cf4fe7de68a35720d2b9338ba9cf182e127d95d72d2ccf7ff5c73a368133663e70c988a460825fa87b2d03717a4447948d5262f56aceb7c3bf1cb3ab5a41a5

    • SSDEEP

      1536:2OCAsdBo+am5OMwr5IlALYKXgAJGsZhTjrjvjCXeO:ZCjta0OMuIlArVJGqT/jveXeO

    Score
    1/10
    behavioral3behavioral4

    • Target

      XWorm-V5.0/Mono.Cecil.Rocks.dll

    • Size

      27KB

    • MD5

      6e7f0f4fff6c49e3f66127c23b7f1a53

    • SHA1

      14a529f8c7ee9f002d1e93dcf8ff158ab74c7e1a

    • SHA256

      2e2623319bdc362974a78ea4a43f4893011ec257884d24267f4594142fcd436e

    • SHA512

      0c773da6717dd6919cd6241d3cee26ab00bb61ea2dbeff24844a067af4c87ff5cbdb2fe3ada5db4707cee921b3fb353bd12ee22b8490597d4f67ad39bace235e

    • SSDEEP

      384:70ve8JOuJ5iC7n2NwxEXCni+VXcMeDz8PmR1ugLoaeuLMBG9UphJAprjE3uFLHa9:7+m4iCyrXOhG8uRssveum1pMFLHFBvd

    Score
    1/10
    behavioral5behavioral6

    • Target

      XWorm-V5.0/Mono.Cecil.dll

    • Size

      350KB

    • MD5

      de69bb29d6a9dfb615a90df3580d63b1

    • SHA1

      74446b4dcc146ce61e5216bf7efac186adf7849b

    • SHA256

      f66f97866433e688acc3e4cd1e6ef14505f81df6b26dd6215e376767f6f954bc

    • SHA512

      6e96a510966a4acbca900773d4409720b0771fede37f24431bf0d8b9c611eaa152ba05ee588bb17f796d7b8caaccc10534e7cc1c907c28ddfa54ac4ce3952015

    • SSDEEP

      6144:jIevdbLPNYe8bikm98KXPHhOWY/fFREomhUFD3z:se1PNL+QRfBg/f/EWFD

    Score
    1/10
    behavioral7behavioral8

    • Target

      XWorm-V5.0/MonoMod.Backports.dll

    • Size

      138KB

    • MD5

      dd43356f07fc0ce082db4e2f102747a2

    • SHA1

      aa0782732e2d60fa668b0aadbf3447ef70b6a619

    • SHA256

      e375b83a3e242212a2ed9478e1f0b8383c1bf1fdfab5a1cf766df740b631afd6

    • SHA512

      284d64b99931ed1f2e839a7b19ee8389eefaf6c72bac556468a01f3eb17000252613c01dbae88923e9a02f3c84bcab02296659648fad727123f63d0ac38d258e

    • SSDEEP

      3072:kRu+JWxtm5UE1cy/4HJW/SwUif9T2FpsP3Y+RJgv:kRTJWfNE1CuSMlTIeTRm

    Score
    1/10
    behavioral10behavioral9

    • Target

      XWorm-V5.0/MonoMod.Core.dll

    • Size

      216KB

    • MD5

      b808181453b17f3fc1ab153bf11be197

    • SHA1

      bce86080b7eb76783940d1ff277e2b46f231efe9

    • SHA256

      da00cdfab411f8f535f17258981ec51d1af9b0bfcee3a360cbd0cb6f692dbcdd

    • SHA512

      a2d941c6e69972f99707ade5c5325eb50b0ec4c5abf6a189eb11a46606fed8076be44c839d83cf310b67e66471e0ea3f6597857a8e2c7e2a7ad6de60c314f7d3

    • SSDEEP

      6144:mV+Fj3NL3NdYIRTdJ3AdHwSOTboZK3MYt:hFj3NL3NdYIRTdJ3AdHp2

    Score
    1/10
    behavioral11behavioral12

    • Target

      XWorm-V5.0/MonoMod.ILHelpers.dll

    • Size

      6KB

    • MD5

      6512e89e0cb92514ef24be43f0bf4500

    • SHA1

      a039c51f89656d9d5c584f063b2b675a9ff44b8e

    • SHA256

      1411e4858412ded195f0e65544a4ec8e8249118b76375050a35c076940826cd0

    • SHA512

      9ffb2ff050cce82dbfbbb0e85ab5f976fcd81086b3d8695502c5221c23d14080f0e494a33e0092b4feb2eda12e2130a2f02df3125733c2f5ec31356e92dea00b

    • SSDEEP

      96:XC5172VL9HZNBrfq7LgcA6S8I2DqDXGnADX62WuauAuRt/0:q8xDfYLgcAMtAXG+rPVL/

    Score
    1/10
    behavioral13behavioral14

    • Target

      XWorm-V5.0/MonoMod.Iced.dll

    • Size

      623KB

    • MD5

      c24584c6b5bc57ac46727ab15e332c4a

    • SHA1

      dadd68f0fa45845fbc30fd0f8f54e8616cdd2d0b

    • SHA256

      ef4a8f28226db390dd07de13afc01c8000e127c978ebf428a6637f39ac277033

    • SHA512

      aabc699eef08e3483049c7ceb48842deddc52284de7f6f72d56d6eccac3989cc373839aeac61f03e7b2af203744d579fd96a4eb911cfdd0461b151c41dc6771d

    • SSDEEP

      6144:Xw98C3SQzlfuStslPYAH+jUmLdf26bfDcj2511Qxu7F:q8CCYlfuGslPn+jvDTDcj251+xuR

    Score
    1/10
    behavioral15behavioral16

    • Target

      XWorm-V5.0/MonoMod.Utils.dll

    • Size

      319KB

    • MD5

      79f1c4c312fdbb9258c2cdde3772271f

    • SHA1

      a143434883e4ef2c0190407602b030f5c4fdf96f

    • SHA256

      f22a4fa1e8b1b70286ecf07effb15d2184454fa88325ce4c0f31ffadb4bef50a

    • SHA512

      b28ed3c063ae3a15cd52e625a860bbb65f6cd38ccad458657a163cd927c74ebf498fb12f1e578e869bcea00c6cd3f47ede10866e34a48c133c5ac26b902ae5d9

    • SSDEEP

      6144:9gPf7SkKpBmBEKFutWL7dyywUQ1MWWavAsXjb:q7Svp8EtO49N

    Score
    1/10
    behavioral17behavioral18

    • Target

      XWorm-V5.0/NAudio.dll

    • Size

      502KB

    • MD5

      3b87d1363a45ce9368e9baec32c69466

    • SHA1

      70a9f4df01d17060ec17df9528fca7026cc42935

    • SHA256

      81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451

    • SHA512

      1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7

    • SSDEEP

      6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS

    Score
    1/10
    behavioral19behavioral20

    • Target

      XWorm-V5.0/Plugins/ActiveWindows.dll

    • Size

      14KB

    • MD5

      bf9b4e4f549e35cf35fcef4732974cb5

    • SHA1

      474f360b4dd138ba53d1dc9f443758933883922a

    • SHA256

      e39fc3003440b0838cd7c0454f2461d95c2c9b9e6886fe346557991fcf3f4e73

    • SHA512

      358b9cc11199d64e52aa46c2c63afce01556fead15cc8c01a898b1a97c4238d832b8894a33866020173e9358543f88f6fea0e57c44e313cb3ba6bb7ef29f0b1e

    • SSDEEP

      192:MpsFElxHxzCXorWcsvaUJwfdBuo1I5+3gqT8AO1tW9Yr6IW1GXZ3+ew7EDmSLOb:DFELRzbrUw/AodT8ptsY7XZ34ED8b

    Score
    1/10
    behavioral21behavioral22

    • Target

      XWorm-V5.0/Plugins/All-In-One.dll

    • Size

      4.8MB

    • MD5

      540d637da9254ebb6d47324014ef3857

    • SHA1

      af168621773eef426bd0ff7313421a56702b6cef

    • SHA256

      dd158430cfe991f17a14fac748934f38079718572a8729fe20935738c1ddaa72

    • SHA512

      9bf869b60baa6c60bb6f2c247ce5a55ab3e901ff3f01957f0a6f5283789d602aa00a881f29f14953f020c9f8f7c18bb54d05fe05bde981360e86ab8b12b50ea8

    • SSDEEP

      98304:tl19F9QORkChiDC9OtH7c2iwGxIvPBOw0JefVfQ2a5cFd4KssODtd:d9FPRkC8C9OH7c2ilInz0kfVo26Wsd

    Score
    1/10
    behavioral23behavioral24

    • Target

      XWorm-V5.0/Plugins/Chat.dll

    • Size

      18KB

    • MD5

      26c9be1bb1475d04ddad32a0bda24c0b

    • SHA1

      5f599f419def5ac239111f61003c64ee15b5e6a5

    • SHA256

      991adcda2cb9e53fc562f653b7c88e14fffc9ef97c4dcba1b7eda4566106a6c5

    • SHA512

      6cfd4a995b797b22356040eec9f5a8314862062b60de5f89c4f11592844533a8be5a6061f5d597fa37dae260f21d195df7486c6ce6fe705b2c8343f34e7baf42

    • SSDEEP

      384:mUeRbCtl+SLFxdQ0C7sKmsfcrwTKvh6GIKoIAfWUWmf9:F4SpxaoKmJr0pIAfWXO

    Score
    1/10
    behavioral25behavioral26

    • Target

      XWorm-V5.0/Plugins/Clipboard.dll

    • Size

      14KB

    • MD5

      c514355155a17531999bdd5e382167fd

    • SHA1

      b84bf384a2d22c2c4e616fc7b2af3227d5eb7e01

    • SHA256

      5bd31830605b3a389456cc2c373d0d07d5bdcc21b1713806af9a2c9803d264fe

    • SHA512

      7f5058405b491fcd76fbdb93a42fbd3dbd46f0531444210b1e1be7788e8ceb89e9ab8ed07cb76a3d32e2012217ec3114f724d7d20b9159d097bef22046b06fbb

    • SSDEEP

      192:f+e2PZKYnw/LzXsJ0zzBa70OFXgNTer149iY6IW1mX/60eCCWk7RSLWMU:p2ZE3sJ0ha70USTe5Wi2X/6TjMU

    Score
    1/10
    behavioral27behavioral28

    • Target

      XWorm-V5.0/Plugins/FileManager.dll

    • Size

      678KB

    • MD5

      e67c3a3f676f9446d19c7ca003b5ecf0

    • SHA1

      c555beef3a7a41039319fd48e9f18becd312f9e5

    • SHA256

      e328c16ee5b6657210be11026baefaaf9ef7c525d2973ae245d24694f0fa6a48

    • SHA512

      4fc37c92baafde41bf5e0173f89e3c1ad49358a6fdaff0d49d7c6c31cc9cafdc93c207856ec50de5528212b67464761192eacc5b547fd422673b12252efa6819

    • SSDEEP

      12288:8AEUQD2M5moOUK1k69TUVSwg2waA1tS5sz9P:9XM5moOUK1k69kSw216s

    Score
    1/10
    behavioral29behavioral30

    • Target

      XWorm-V5.0/Plugins/FileSeacher.dll

    • Size

      478KB

    • MD5

      405f2771409e90a4bb93ed4d9aa06f1e

    • SHA1

      64fa9363795f2b235dc0d4337e1bc678b10b0836

    • SHA256

      65f22d8fe8d4eb97c081c938a8627d25911b6d29379a95136abd0653f9b2c0fd

    • SHA512

      63e8ac5bf334dddd22fa1b9f434dca5f16d104a54d98cee7dd138e5387416c7645e0819da823523fa83a73d02773806925296346138d9a7ee03f27a343b94a28

    • SSDEEP

      6144:K88L5lWTUVRTw/l97teGtSV41QJDsTDDh0Yhe6dwxLV/tuhgpn5YWRBI+WR:LzTUVRTw1lS4Ys50ie6Cf4gpts

    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Matrix

Tasks

static1

agilenetagentteslaxworm
Score
10/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10