Overview

overview

10

Static

static

10

552cfe1d32...a6.exe

windows7-x64

10

552cfe1d32...a6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0acba1286459f5cb25abaf5af57d1fc75b720d8da7adfe2dda683dfb43931d14

  • Size

    17KB

  • Sample

    240419-wcf2habh2x

  • MD5

    d8b49c70a0bd95597c4304f9ebe13561

  • SHA1

    9a8f689518979a64dd0e3b9e1a7e3ebb269ce394

  • SHA256

    0acba1286459f5cb25abaf5af57d1fc75b720d8da7adfe2dda683dfb43931d14

  • SHA512

    bd5076ac0ab380c05376cef22f018ced3c718e4cb75e8b91a11e625ecb9540b60424e558236dde14451cc6cc9f6043458519567640687442029dd6603e476c1c

  • SSDEEP

    384:/BUEZb0Tvk1gqs+8x6ry+YUuWDhs0FEG64Gv9/Ytb:5LaT8DSmYZIhs0FU4u9/Ytb

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

3.1

C2

janxworm9090.duckdns.org:9090

Mutex

Xa2HMWUMGteOPIQ2

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

aes.plain

Targets

    • Target

      552cfe1d324eabb78511924dbbbf870fe10fe742d88a708f0012f47091ec04a6.exe

    • Size

      35KB

    • MD5

      d0ae55e5bf52296ac522d8d2acaeb933

    • SHA1

      bb15b9ebcfaefa5aff4eeed1899def45e3a7b21f

    • SHA256

      552cfe1d324eabb78511924dbbbf870fe10fe742d88a708f0012f47091ec04a6

    • SHA512

      3b66345dcd998bcfc67ca02be70224b6dfa63023548bfaa482a38b81d2bc551999867d14e3c7b9281e87c4c7433f685854768279128f1af07e675b8a3de640f5

    • SSDEEP

      384:wgg9j00WbqxAMTayV5N+5maFZZL3aHpJm3/KNm0ns0VgtFMAmNLToZw/RZCvK9IX:yB4QBTOl3aC3CNUVFQ92g7OMhUuvlE

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks