Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

30/12/2024, 20:44

241230-zjcjfazrhy 8

26/11/2024, 18:42

241126-xche1atnb1 8

26/11/2024, 18:41

241126-xbwk8stnat 4

11/04/2024, 09:32

240411-lhs8xagf79 10

11/04/2024, 09:21

240411-lbmgsage63 10

General

  • Target

    https://www.upload.ee/download/15657107/813ac1d2bfa81d7f177e/XWorm-V5.0.rar

  • Sample

    240411-lhs8xagf79

Malware Config

Extracted

Family

xworm

Version

3.1

C2

full-wet.at.ply.gg:38848

Attributes
  • Install_directory

    %AppData%

  • install_file

    chrome.exe

Targets

    • Target

      https://www.upload.ee/download/15657107/813ac1d2bfa81d7f177e/XWorm-V5.0.rar

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Checks CPU information

      Checks CPU information which indicate if the system is an emulator.

    • Checks memory information

      Checks memory information which indicate if the system is an emulator.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

MITRE ATT&CK Mobile v15

Tasks