Overview

overview

10

Static

static

10

6045030af3...05.exe

windows7-x64

10

6045030af3...05.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    635fe6a59f6cc90647addf668ccab6b4fdf7eceb17f887d984b79cfc5c01addc

  • Size

    16KB

  • Sample

    240419-vpajtaba4z

  • MD5

    1e6577d6f020c1c5e3f68feb865cac52

  • SHA1

    67acf8f551d70529eb7c1067fa2562bacf8cdb57

  • SHA256

    635fe6a59f6cc90647addf668ccab6b4fdf7eceb17f887d984b79cfc5c01addc

  • SHA512

    6fb582d3bc10fcb7c8b2e0b358302f86051335155d4b9d86bbf40fbed2205c5df5df2e4460966b26a442063821a08125482222fc52d30795710d150b221377b8

  • SSDEEP

    192:Jf/+4EhJmNhZSHNxeE07FLlWG76Oq6EA1xrNVNq69gMXJLuPbIY2racffnQJmpuQ:17E7mNeHLI7FAMXNqCXJaqfhp+W6uVb

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

warzones12.duckdns.org:7000

Mutex

jq3PfRyUTLkExGhb

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      6045030af3412c4670b042c08f7fbf0e31b670e679724388b9192fb512a1e705.exe

    • Size

      33KB

    • MD5

      7bee99c5c6ceae09126f113375a12187

    • SHA1

      056bc71fc92325e0a8cee132c7d2f14f0a481175

    • SHA256

      6045030af3412c4670b042c08f7fbf0e31b670e679724388b9192fb512a1e705

    • SHA512

      0b024756a56c6f47f4164efc6b3e66e0750734b2d5d54b8e187e44e5761f6edd98ac115eb9b7f38c7c78b4e71f697ff7f66d0dc1dfeddab09f7df5f8ef46e7d3

    • SSDEEP

      384:Vl+PkjD9+E5MFs7iui8L7zKM42pfL3iB7OxVqWFiRApkFXBLTsOZwpGN2v99Ikuz:v+CD93W03v42JiB70SVF49jGOjhvbC

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks