Overview

overview

10

Static

static

1

obf3.ps1

windows7-x64

1

obf3.ps1

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    obf3.ps1

  • Size

    479KB

  • Sample

    240424-t1bqksdc35

  • MD5

    d9512135951276f5f326013b254a9a0a

  • SHA1

    fa52e13b51acc4decb0c8b5b614ffcdc170c0c18

  • SHA256

    3127e2e95520523dc6e706517e88c33f5880bb103038d5b70823c8bf289c0917

  • SHA512

    3da16e4269ae73459531e0e90928b3eb448f6d28d3e9c72d411b81399f76d10c85f255198b2dca6304d7d08905cfa5577648aa49d760cb5b68c8de2cba5210ce

  • SSDEEP

    12288:IADdI0lI2/xs4HqS8qnqjNGt5l1B9VNAez9RwTZ0Lz4:NDdI0lIX4VUEcepRwTyLz4

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

3.1

C2

91.92.252.116:1111

Mutex

vuG6ZrO3fig2tDuO

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      obf3.ps1

    • Size

      479KB

    • MD5

      d9512135951276f5f326013b254a9a0a

    • SHA1

      fa52e13b51acc4decb0c8b5b614ffcdc170c0c18

    • SHA256

      3127e2e95520523dc6e706517e88c33f5880bb103038d5b70823c8bf289c0917

    • SHA512

      3da16e4269ae73459531e0e90928b3eb448f6d28d3e9c72d411b81399f76d10c85f255198b2dca6304d7d08905cfa5577648aa49d760cb5b68c8de2cba5210ce

    • SSDEEP

      12288:IADdI0lI2/xs4HqS8qnqjNGt5l1B9VNAez9RwTZ0Lz4:NDdI0lIX4VUEcepRwTyLz4

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks