Overview

overview

10

Static

static

10

8048406056...c2.exe

windows7-x64

10

8048406056...c2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    12144ee828cdecaf85781e65da70f47c4864257d0347acc8f47504cea49a9ae2

  • Size

    17KB

  • Sample

    240419-vw35psae24

  • MD5

    75ed948e6403ca607ab2235fd8d2f867

  • SHA1

    424527096800d156706f730b51fca0e1cb1e33be

  • SHA256

    12144ee828cdecaf85781e65da70f47c4864257d0347acc8f47504cea49a9ae2

  • SHA512

    0670555527d32266aed788f65638f571dc21163cd9d867fad14d2d819ee98c9ff42e52533b6ad4d2df8e094d30e908fbe0196b441802526bc750752616649b98

  • SSDEEP

    384:fnmsaFa3xGTfdaqfkNtqZPRB+TtLAuBoi1GIX811:fmsak3sYqfkNtAPzsLcmA1

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

xwormv5.duckdns.org:7001

Mutex

HFI6yL8sUHXxcfPL

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      8048406056b1a1a91b56725c1c0b89e3b8060bf5a45861484a73728d222ccbc2.exe

    • Size

      36KB

    • MD5

      18c39555a622debfb3ba300977bbfbd4

    • SHA1

      96585e3375f47247e53ae64236c6364c25484ab5

    • SHA256

      8048406056b1a1a91b56725c1c0b89e3b8060bf5a45861484a73728d222ccbc2

    • SHA512

      ea1075e6d3416c6dfbeeb2a3551bfb1ff210f15454aa0375c8dee1dc4405acc15753234d8de311217581505bfaf4da8c614188880a5aab5fae9bcae96adc6223

    • SSDEEP

      768:PGLtt3QRH9ucNCQISkHIpgLHbFa9YKOMhHQG:PAb3QRH9uczTkomL7Fa9YKOM5h

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks