Overview

overview

10

Static

static

10

XWorm-V5.0...64.exe

windows7-x64

3

XWorm-V5.0...64.exe

windows10-2004-x64

3

XWorm-V5.0...er.exe

windows7-x64

10

XWorm-V5.0...er.exe

windows10-2004-x64

10

Resubmissions

08/04/2024, 14:10

240408-rg3c3sba4510

08/04/2024, 14:07

240408-re6bysah7410

Sharing

Copy URL Twitter E-mail

General

  • Target
    XWorm-V5.0.rar
  • Size 28.8MB
  • Sample240408-rg3c3sba45
  • SHA256 c2a1b97d657542e949496bc96e5a6c4e0beb101a629e7591519d0cb7e906dbfa
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
agentteslaxwormagilenetrattrojan

Malware Config

Extracted

Family

  • xworm

Version

  • 5.0

C2

  • testarosa.duckdns.org:7110

Mutex

  • Rg1w8TcZ1AXGhMnB

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    WindowsDefender.exe

aes.plain

Targets

    • Target
      XWorm-V5.0/FixNoStart/Fix64.exe
    • Size 101KB
    • SHA256 62a14b870bde8d57e50360039d3474210d1fdaf490afdd1bf36ce92fbaff893b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral1behavioral2
    • Target
      XWorm-V5.0/XWormLoader.exe
    • Size 111KB
    • SHA256 1f10356e86d377e76ab31ca4401f0f49f4caa9587227c61c56f8fc38dc4d7bda
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks