Overview

overview

10

Static

static

10

73be2761ef...07.exe

windows7-x64

10

73be2761ef...07.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ed853eb3854042f75699a633e2166dc34d34089aecfd833378e49d161966333e

  • Size

    35KB

  • Sample

    240419-vn2a5sba3z

  • MD5

    b18fced970a122abe2494c606e5cb443

  • SHA1

    6a4378a6d38e28e1025717427f2e63de1332e9dd

  • SHA256

    ed853eb3854042f75699a633e2166dc34d34089aecfd833378e49d161966333e

  • SHA512

    4ca35f25bea8fed6b0a95d3a49ebf6a3e076cb9347d40ee58f58b7edaf9dcb18b8909a42e738a50a5e8c60f0d3415396fe2101bf9ad1ede5cf0c64b4686eb4b7

  • SSDEEP

    768:7I91m9NSSjocMmkqzVmMB8ZDNQNeZdYi04z4btrhEZ2ZXK7:091OSOtVx8ZuewR4zstVVK7

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

C2

powerup.dynuddns.net:5656

Attributes
  • Install_directory

    %AppData%

  • install_file

    security.exe

Targets

    • Target

      73be2761ef92433223e1775047b843d237dd5994e1a7ca3dc994e3737a2a7f07.exe

    • Size

      58KB

    • MD5

      f364862ab418ad1ad09c767f6c6a7e2c

    • SHA1

      2de18f4626f4b57df75874073d5948e78891e354

    • SHA256

      73be2761ef92433223e1775047b843d237dd5994e1a7ca3dc994e3737a2a7f07

    • SHA512

      bd7c6c4aa15bf412e418ca0dbf8e493a26cd84c191275fe0624ada4c1bf5ba10bf9379f35421a338463b0312df4f5de419d8afb2f9282e642dedb1d0d622dd20

    • SSDEEP

      1536:NqEXK2nOkAicN+VEVGYQ+bq19hqVMqOvIf1:I2RVEoL+bq1OOgN

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks