Overview

overview

10

Static

static

10

7f52c7211c...e8.exe

windows7-x64

10

7f52c7211c...e8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3b566eacecc241ef8de81e7bb57720f8f538a169597ecebb6747305cf33e2657

  • Size

    18KB

  • Sample

    240419-vpd71aab74

  • MD5

    ccfac62b952a8d263718b2f0ef5cd063

  • SHA1

    4677ce0fd9949772c0b293d636dc8e192739876c

  • SHA256

    3b566eacecc241ef8de81e7bb57720f8f538a169597ecebb6747305cf33e2657

  • SHA512

    1438e370893346fc8ed0c566bb8285b53365bc82149972e2594c22213b0a26f37cdbcc78f03cdf17248719b762029a0fe88cf9a2fcbb598681bb93541837793b

  • SSDEEP

    384:CW6u3+J39dwruwsS8rxKHGgPcglH2m8o8e9V01XZrIOEa5LM:N6u3Kfwt8dcRc4yaV01XZ3U

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

137.184.9.205:7000

Mutex

OaAcKYAEIbGGlgzJ

Attributes
  • install_file

    USB.exe

  • telegram

    https://api.telegram.org/bot6567817661:AAEPVH8mr4mtxVjaqzlho_8xxGuixiJIukE

aes.plain

Targets

    • Target

      7f52c7211cbc86a61f10853d66f34a22c61cc306f706e62d25b19d6ffa1418e8.exe

    • Size

      37KB

    • MD5

      42699125d26517469d8a3c714be4a16a

    • SHA1

      919d9b1a2f544125d0a406c548fe1cf25f5263da

    • SHA256

      7f52c7211cbc86a61f10853d66f34a22c61cc306f706e62d25b19d6ffa1418e8

    • SHA512

      4c045a4c1425b1ca8de43ce8c21698c47769eec2eae33d1d2db78a33267d927ed4647f178d57cddd9f7a48da7c459772d368a70ed2bdf11ee1de18e998e72cf7

    • SSDEEP

      384:IeOSrHiWIjrdTadLwxwCUOCFFniFyNd9jMJrqpkFE+LT/OZwEci2v99Ik1isZgYK:WrtcCSFniFyh2dFh9gcSO1hfqVgXK

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks