xworm

General

Target

LzFE9kDPVuOiAHeAkCumoRWhFzAt55DFiHAEX8Z8.zip
Size

535KB
Sample

240420-b7q5qsec2s
MD5

11e7644c95387c1860ce7e936c749f74
SHA1

a483dfec45aa156c31e5600b88ef043f23fbaaf1
SHA256

8641f88b89c9076ece3ee571baa4b3c93ba3ac3883e90fe5f894dc41e3b7bdc7
SHA512

d9ffbf735346887b7c4922fa6fb5a2c08d73cd8874cca3c36211b87138134ae718ecb16d593e7ca9aceb634ae7655cf61b2fd1d255be5f3b9f580aa072aef0f5
SSDEEP

12288:vogNRCQ0wbQDG8kjVy9KhxHu7G6h4AbKuZYWRApRs3Of/K:NNRKVkMUTHu7puWRas+HK

Score

10^/10

Malware Config

Extracted

Family

xworm

Attributes

Install_directory
%Public%
install_file
svchost.exe
pastebin_url
https://pastebin.com/raw/UWpQULMP

Targets

- Target
  
  Ro-exec/Defender_Settings.vbs
- Size
  
  313B
- MD5
  
  b0bf0a477bcca312021177572311e666
- SHA1
  
  ea77332d7779938ae8e92ad35d6dea4f4be37a92
- SHA256
  
  af42a17d428c8e9d6f4a6d3393ec268f4d12bbfd01a897d87275482a45c847e9
- SHA512
  
  09366608f2670d2eb0e8ddcacd081a7b2d7b680c4cdd02494d08821dbdf17595b30e88f6ce0888591592e7caa422414a895846a268fd63e8243074972c9f52d8
Score

1^/10
behavioral1
- Target
  
  Ro-exec/READ ME (ro-exec).txt
- Size
  
  1KB
- MD5
  
  6c01f5ff64c164e309b428ee19262f98
- SHA1
  
  98fdeb43b979f694ae32ebff06b2635c49d34b9d
- SHA256
  
  34b458a5e71bc3db5a331e0ef951c2eafbb689145ca6d91f95a26a8e1afddb94
- SHA512
  
  95b5eacc0f3a09f04115eb3933f1e06b0b2da0c7166ac333e6c4af6838efea7966d809a37a26f1456ff3f06d48a84350314b0cf6cfe8ffe2b8cf973a06a4eb06
Score

3^/10
behavioral2
- Target
  
  Ro-exec/dControl.ini
- Size
  
  85KB
- MD5
  
  05450ff06366ae22654b63a6e27d1624
- SHA1
  
  11453c370f41287fb6339e509bb9d3c91842b379
- SHA256
  
  8e9a84da243905685ca77b6ef71841e610b88b7963d4de59f6dcbdd1621ecacd
- SHA512
  
  ee0a9605b566aa89c8c9b260e1d9c15aecbd6cddc2df47fe24ef2cafbe8923b3e025bd5cd3d34499292589a3c094dd796ab4560c8099bad2051a54928c37b4b2
- SSDEEP
  
  768:i/G+NmPfjsxaxdk2akexodULxEQq1wIgC+AEbSr6:1+NyjsxkKdkJdULgbWSO
Score

3^/10
behavioral3
- Target
  
  Ro-exec/defcon.exe
- Size
  
  447KB
- MD5
  
  58008524a6473bdf86c1040a9a9e39c3
- SHA1
  
  cb704d2e8df80fd3500a5b817966dc262d80ddb8
- SHA256
  
  1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326
- SHA512
  
  8cf492584303523bf6cdfeb6b1b779ee44471c91e759ce32fd4849547b6245d4ed86af5b38d1c6979729a77f312ba91c48207a332ae1589a6e25de67ffb96c31
- SSDEEP
  
  6144:Vzv+kSn74iCmfianQGDM3OXTWRDy9GYQDUmJFXIXHrsUBnBTF8JJCYrYNsQJzfgu:Vzcn7EanlQiWtYhmJFSwUBLcQZfgiD
Score

7^/10

upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
behavioral4
- Target
  
  out.upx
- Size
  
  653KB
- MD5
  
  6970ea0b6597dcd5b4f5f19f28e958a8
- SHA1
  
  a0130bb7ac03ec4799c90781ca93fd1392c6d54c
- SHA256
  
  481e03978ca339ce697252895efe89b09fefd3098ad247d24eeb6cca9969f553
- SHA512
  
  bc95cbe9a050e3d3b713745ef399bf2817d38f8e019f6edffdd2bf755badbde766e434e39a7f32356125bba0692b694c18da8dd0762aac0c9430d45acb215e01
- SSDEEP
  
  12288:nkxDoouVA2nxKkhEvdRgQriDJOIlW+yBGQowlNCWS:RRmJkioQrilOIc+yMx
Score

3^/10
behavioral5
- Target
  
  Ro-exec/ezdebug.png
- Size
  
  49KB
- MD5
  
  654dfa5c392f08728a7acc79587ecdd1
- SHA1
  
  56a1abc7ac86e7275c8fac870700417d724c66ea
- SHA256
  
  65792581029de7e992a20f67e1ebca3031c258e743f0f6f0f29d60f880573c32
- SHA512
  
  2c30c6972686a03e6c5fc89a024eaf3ceeb81b1fd8c19e2f8c652effa4e1e0e7171dfe1d17f95ad2e623ce5dfd80242489ffb3294f1928382ebae41ce764abb7
- SSDEEP
  
  1536:kNfMc6jr372U55shDVmWcEaOH5UWRxrL5PYpBv:kNf67glVmWcz+7RxZYpR
Score

3^/10
behavioral6
- Target
  
  Ro-exec/loader-upd.exe
- Size
  
  70KB
- MD5
  
  573bd20fc8382d92a7ae9eae51e738e3
- SHA1
  
  55006093429df791f27e91a66e5ee63a81382b28
- SHA256
  
  09036ffa342f9e5bb1e31a867dcc3b60db011baba8c0d202aff1d33195cbe729
- SHA512
  
  d38736acff4128d6ce9ea17ee609ca33a37ac88f2c994cf4caf7f0eb62406a8963c33531b9f3cd020974d892c2751f3a4f67ce13ed6ba6080f97c406ccbb4aca
- SSDEEP
  
  1536:PmMfwrNATngx6fPLgD9vYebv2S5NiwWW6N9dOoihkAO:LCmn463UD6ebv242FzOoiSAO
Score

10^/10

xworm persistence rat trojan
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
behavioral7